From: Christian Lamparter <chunkeey@web.de>
Date: Mon, 19 Jan 2009 23:27:57 +0000 (+0100)
Subject: p54usb: fix nasty use after free
X-Git-Tag: v2.6.29-rc3~23^2~30
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e2fe154e918276e900067a9d1d3a6a963faee041;p=pandora-kernel.git

p54usb: fix nasty use after free

In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

Reading git-diff-tree failed