musb: potential use after free

We assign "urb->hcpriv = qh;" a few lines down. I'm pretty sure we want it "urb->hcpriv" to be NULL not a freed value. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@nokia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
git-mirror · Apr 30, 2010 · 714bc5e · 714bc5e
1 parent 5e0e61a
commit 714bc5e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
@@ -2042,6 +2042,7 @@ static int musb_urb_enqueue(
 		 * odd, rare, error prone, but legal.
 		 */
 		kfree(qh);
+		qh = NULL;
 		ret = 0;
 	} else
 		ret = musb_schedule(musb, qh,