From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Date: Wed, 12 Sep 2012 11:48:31 +0000 (+0300)
Subject: usb: move children deallocation after quiescing the hub
X-Git-Tag: omap-for-v3.7-rc1/fixes-cpufreq-signed~73^2~136
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1f2235b8e79bd276f19809f7f2a270f55909d695;p=pandora-kernel.git

usb: move children deallocation after quiescing the hub

Commit ff823c79a5c33194c2e5594f7c4686ea3547910c ("usb: move children
to struct usb_port") forgot to consider the hub_disconnect sequence,
which releases ports before quiescing the hub, which will lead to a
use-after-free, since hub_quiesce() will try to disconnect ports'
children, which are already deallocated. Simple modprobe dummy_hcd &&
rmmod dummy_hcd will illustrate the problem.

This patch moves deallocation of hub's ports after hub_quiesce() call
in hub_disconnect().

Cc: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

Reading git-diff-tree failed