From: Alan Stern Date: Thu, 19 Jul 2012 20:08:21 +0000 (-0400) Subject: HID: usbhid: fix use-after-free bug X-Git-Tag: v3.6-rc1~119^2~1^5~5 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=668160e5a80536251b4931a332dfe34d6ec2aeb7;p=pandora-kernel.git HID: usbhid: fix use-after-free bug This patch (as1592) fixes an obscure problem in the usbhid driver. Under some circumstances, a control or interrupt-OUT URB can be submitted twice. This will happen if the first submission fails; the queue pointers aren't updated, so the next time the queue is restarted the same URB will be submitted again. The problem is that raw_report gets deallocated during the first submission. The second submission will then dereference and try to free an already-freed region of memory. The patch fixes the problem by setting raw_report to NULL when it is deallocated and checking for NULL before dereferencing it. Signed-off-by: Alan Stern CC: Oliver Neukum Signed-off-by: Jiri Kosina --- Reading git-diff-tree failed