From: Alexey Khoroshilov <khoroshilov@ispras.ru>
Date: Sun, 10 Aug 2014 16:35:11 +0000 (+0700)
Subject: usb: dbgp gadget: fix use after free in dbgp_unbind()
X-Git-Tag: omap-fixes-against-v3.17-rc3~24^2~15^2~12
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4958cf32f66df854b932b601eef2da3f95973339;p=pandora-kernel.git

usb: dbgp gadget: fix use after free in dbgp_unbind()

After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.

The patch sets pointers to NULL in dbgp_unbind().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
---

Reading git-diff-tree failed