From: Oliver Neukum <oneukum@suse.de>
Date: Wed, 13 Jun 2007 16:50:41 +0000 (+0200)
Subject: USB: fix race leading to use after free in io_edgeport
X-Git-Tag: v2.6.22-rc7~49^2~2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=74ac07e8b8209ba9429fa1a9afc07aa5ecef5af8;p=pandora-kernel.git

USB: fix race leading to use after free in io_edgeport

usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()


Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

Reading git-diff-tree failed