[media] gspca: only set gspca->int_urb if submitting it succeeds

Currently alloc_and_submit_int_urb() is setting gspca->int_urb
as soon as the allocation has succeeded, but if the subsequent
submit fails, the urb gets destroyed. And then later will
get destroyed again in gspca_input_destroy_urb() because
gspca->int_urb is set, leading to a double free.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index dbd63c542317a6c016a7c1859227635f34c24c1e..a089fcaed8adba71e1ac6d35433012d93a6fd8d7 100644 (file)
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -224,12 +224,12 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                buffer, buffer_len,
                int_irq, (void *)gspca_dev, interval);
        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
-       gspca_dev->int_urb = urb;
        ret = usb_submit_urb(urb, GFP_KERNEL);
        if (ret < 0) {
                PDEBUG(D_ERR, "submit int URB failed with error %i", ret);
                goto error_submit;
        }
+       gspca_dev->int_urb = urb;
        return ret;
 
 error_submit: