提交 22f675f3 编写于 作者: J Jiri Kosina

HID: Never call hid_free_buffers() when usbhid_device has been freed

We can't call hid_free_buffers() when the underlying usbhid_device
has already been freed.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
上级 cda5ecf8
...@@ -877,9 +877,9 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf) ...@@ -877,9 +877,9 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbin);
usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbout);
usb_free_urb(usbhid->urbctrl); usb_free_urb(usbhid->urbctrl);
hid_free_buffers(dev, hid);
kfree(usbhid); kfree(usbhid);
fail_no_usbhid: fail_no_usbhid:
hid_free_buffers(dev, hid);
hid_free_device(hid); hid_free_device(hid);
return NULL; return NULL;
...@@ -913,9 +913,9 @@ static void hid_disconnect(struct usb_interface *intf) ...@@ -913,9 +913,9 @@ static void hid_disconnect(struct usb_interface *intf)
usb_free_urb(usbhid->urbin); usb_free_urb(usbhid->urbin);
usb_free_urb(usbhid->urbctrl); usb_free_urb(usbhid->urbctrl);
usb_free_urb(usbhid->urbout); usb_free_urb(usbhid->urbout);
kfree(usbhid);
hid_free_buffers(hid_to_usb_dev(hid), hid); hid_free_buffers(hid_to_usb_dev(hid), hid);
kfree(usbhid);
hid_free_device(hid); hid_free_device(hid);
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册