| Message ID | 20210814105822.GA67154@nilus-desk |
|---|---|
| State | New |
| Headers | show |
| Series | media: usb: tm6000:clear the freed pointer | expand |
On Sat, Aug 14, 2021 at 06:58:22PM +0800, Nil Yi wrote: > After free the ir->int_urb, the pointer need to > be set to NULL. Again, in the commit message please explain what code path will lead to 😱. Thanks, Sean > > Signed-off-by: Nil Yi <teroincn@163.com> > --- > drivers/media/usb/tm6000/tm6000-input.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/media/usb/tm6000/tm6000-input.c b/drivers/media/usb/tm6000/tm6000-input.c > index 84602edf3..49acb97ca 100644 > --- a/drivers/media/usb/tm6000/tm6000-input.c > +++ b/drivers/media/usb/tm6000/tm6000-input.c > @@ -346,6 +346,7 @@ static int __tm6000_ir_int_start(struct rc_dev *rc) > ir->int_urb->transfer_buffer = kzalloc(size, GFP_ATOMIC); > if (!ir->int_urb->transfer_buffer) { > usb_free_urb(ir->int_urb); > + ir->int_urb = NULL; > return err; > } > dprintk(1, "int interval: %d\n", dev->int_in.endp->desc.bInterval); > -- > 2.17.1 >
diff --git a/drivers/media/usb/tm6000/tm6000-input.c b/drivers/media/usb/tm6000/tm6000-input.c index 84602edf3..49acb97ca 100644 --- a/drivers/media/usb/tm6000/tm6000-input.c +++ b/drivers/media/usb/tm6000/tm6000-input.c @@ -346,6 +346,7 @@ static int __tm6000_ir_int_start(struct rc_dev *rc) ir->int_urb->transfer_buffer = kzalloc(size, GFP_ATOMIC); if (!ir->int_urb->transfer_buffer) { usb_free_urb(ir->int_urb); + ir->int_urb = NULL; return err; } dprintk(1, "int interval: %d\n", dev->int_in.endp->desc.bInterval);
After free the ir->int_urb, the pointer need to be set to NULL. Signed-off-by: Nil Yi <teroincn@163.com> --- drivers/media/usb/tm6000/tm6000-input.c | 1 + 1 file changed, 1 insertion(+)