usb: usbip: set buffer pointers to NULL after free

commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream.

The usbip stack dynamically allocates the transfer_buffer and
setup_packet of each urb that got generated by the tcp to usb stub code.
As these pointers are always used only once we will set them to NULL
after use. This is done likewise to the free_urb code in vudc_dev.c.
This patch fixes double kfree situations where the usbip remote side
added the URB_FREE_BUFFER.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust filenames]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/staging/usbip/stub_main.c b/drivers/staging/usbip/stub_main.c
index 2d6317850064aea62cca1119e054f1d79f0e0c0a..2446e09666b412863364f236b69be938df802392 100644 (file)
--- a/drivers/staging/usbip/stub_main.c
+++ b/drivers/staging/usbip/stub_main.c
@@ -237,7 +237,11 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
                kmem_cache_free(stub_priv_cache, priv);
 
                kfree(urb->transfer_buffer);
+               urb->transfer_buffer = NULL;
+
                kfree(urb->setup_packet);
+               urb->setup_packet = NULL;
+
                usb_free_urb(urb);
        }
 }

diff --git a/drivers/staging/usbip/stub_tx.c b/drivers/staging/usbip/stub_tx.c
index 023fda305be292a89be270b146da9321d43eeba8..1d01109017bb5f4544a2770d16662eaa2c74bf04 100644 (file)
--- a/drivers/staging/usbip/stub_tx.c
+++ b/drivers/staging/usbip/stub_tx.c
@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struct stub_priv *priv)
        struct urb *urb = priv->urb;
 
        kfree(urb->setup_packet);
+       urb->setup_packet = NULL;
+
        kfree(urb->transfer_buffer);
+       urb->transfer_buffer = NULL;
+
        list_del(&priv->list);
        kmem_cache_free(stub_priv_cache, priv);
        usb_free_urb(urb);