提交 e57b641d 编写于 作者: A Adrian Bunk 提交者: Jeff Garzik

[netdrvr/usb] hso_create_bulk_serial_device(): fix a double free

hso_serial_common_free() mustn't be called if
hso_serial_common_create() fails.
Reported-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
上级 54069511
...@@ -2211,14 +2211,14 @@ static struct hso_device *hso_create_bulk_serial_device( ...@@ -2211,14 +2211,14 @@ static struct hso_device *hso_create_bulk_serial_device(
USB_DIR_IN); USB_DIR_IN);
if (!serial->in_endp) { if (!serial->in_endp) {
dev_err(&interface->dev, "Failed to find BULK IN ep\n"); dev_err(&interface->dev, "Failed to find BULK IN ep\n");
goto exit; goto exit2;
} }
if (! if (!
(serial->out_endp = (serial->out_endp =
hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, USB_DIR_OUT))) { hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, USB_DIR_OUT))) {
dev_err(&interface->dev, "Failed to find BULK IN ep\n"); dev_err(&interface->dev, "Failed to find BULK IN ep\n");
goto exit; goto exit2;
} }
serial->write_data = hso_std_serial_write_data; serial->write_data = hso_std_serial_write_data;
...@@ -2231,9 +2231,10 @@ static struct hso_device *hso_create_bulk_serial_device( ...@@ -2231,9 +2231,10 @@ static struct hso_device *hso_create_bulk_serial_device(
/* done, return it */ /* done, return it */
return hso_dev; return hso_dev;
exit2:
hso_serial_common_free(serial);
exit: exit:
if (hso_dev && serial)
hso_serial_common_free(serial);
kfree(serial); kfree(serial);
hso_free_device(hso_dev); hso_free_device(hso_dev);
return NULL; return NULL;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册