git://ftp.safe.ca / safe / jmp / linux-2.6 / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 83fbcdc) | patch
USB: xhci: Don't touch xhci_td after it's freed.
authorSarah Sharp <sarah.a.sharp@linux.intel.com>
Thu, 27 Aug 2009 21:36:14 +0000 (14:36 -0700)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 23 Sep 2009 13:46:18 +0000 (06:46 -0700)
commit9191eee7b8a0e18c07c06d6da502706805cab6d2
treea182a6397331ef8ccbeb1d549f5f3e638d256ffftree | snapshot
parent83fbcdcca03013bb5af130d6d91eba11e3d3269ecommit | diff
USB: xhci: Don't touch xhci_td after it's freed.

On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver.  Don't touch urb->td after it's freed.  This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/host/xhci-ring.c diff | blob | history
Full containers within linux kernel