From d993670ca97f646db1ef9b345e78ecfd3d6f0143 Mon Sep 17 00:00:00 2001 From: Thomas Pugliese Date: Thu, 26 Sep 2013 14:08:13 -0500 Subject: [PATCH] usb: wusbcore: allow wa_xfer_destroy to clean up partially constructed xfers If __wa_xfer_setup fails, it can leave a partially constructed wa_xfer object. The error handling code eventually calls wa_xfer_destroy which does not check for NULL before dereferencing xfer->seg which could cause a kernel panic. This change also makes sure to free xfer->seg which was being leaked for all transfers before this change. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman --- drivers/usb/wusbcore/wa-xfer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 47cbfddad159..d2c7b2bb17c1 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -178,9 +178,15 @@ static void wa_xfer_destroy(struct kref *_xfer) if (xfer->seg) { unsigned cnt; for (cnt = 0; cnt < xfer->segs; cnt++) { - usb_free_urb(xfer->seg[cnt]->dto_urb); - usb_free_urb(&xfer->seg[cnt]->tr_urb); + if (xfer->seg[cnt]) { + if (xfer->seg[cnt]->dto_urb) { + kfree(xfer->seg[cnt]->dto_urb->sg); + usb_free_urb(xfer->seg[cnt]->dto_urb); + } + usb_free_urb(&xfer->seg[cnt]->tr_urb); + } } + kfree(xfer->seg); } kfree(xfer); } -- 2.39.5