Skip to content

Commit e7c8e86

Browse files
Julia Lawallgregkh
Julia Lawall
authored andcommitted
drivers/usb/class/cdc-acm.c: clear dangling pointer
On some failures, the country_code field of an acm structure is freed without freeing the acm structure itself. Elsewhere, operations including memcpy and kfree are performed on the country_code field. The patch sets the country_code field to NULL when it is freed, and likewise sets the country_code_size field to 0. Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Oliver Neukum <oneukum@suse.de> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1 parent 5632c82 commit e7c8e86

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

drivers/usb/class/cdc-acm.c

+4
Original file line numberDiff line numberDiff line change
@@ -1230,6 +1230,8 @@ static int acm_probe(struct usb_interface *intf,
12301230
i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
12311231
if (i < 0) {
12321232
kfree(acm->country_codes);
1233+
acm->country_codes = NULL;
1234+
acm->country_code_size = 0;
12331235
goto skip_countries;
12341236
}
12351237

@@ -1238,6 +1240,8 @@ static int acm_probe(struct usb_interface *intf,
12381240
if (i < 0) {
12391241
device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
12401242
kfree(acm->country_codes);
1243+
acm->country_codes = NULL;
1244+
acm->country_code_size = 0;
12411245
goto skip_countries;
12421246
}
12431247
}

0 commit comments

Comments
 (0)