| Message ID | 20210814102939.GA66862@nilus-desk |
|---|---|
| State | Accepted |
| Commit | c9458c6f8a8f9c8b09fef0e2a4d5798ded993ef8 |
| Headers | show |
| Series | media: rc: clean the freed urb pointer to avoid double free | expand |
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c index 2ca4e86c7..54da6f600 100644 --- a/drivers/media/rc/imon.c +++ b/drivers/media/rc/imon.c @@ -2358,8 +2358,10 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf, touch_setup_failed: find_endpoint_failed: usb_put_dev(ictx->usbdev_intf1); + ictx->usbdev_intf1 = NULL; mutex_unlock(&ictx->lock); usb_free_urb(rx_urb); + ictx->rx_urb_intf1 = NULL; rx_urb_alloc_failed: dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
After freed rx_urb, we should set the second interface urb to NULL, otherwise a double free would happen when the driver is removed from the first interface. Signed-off-by: Nil Yi <teroincn@163.com> --- drivers/media/rc/imon.c | 2 ++ 1 file changed, 2 insertions(+)