Commit:     74ac07e8b8209ba9429fa1a9afc07aa5ecef5af8
Parent:     5afeb104e7901168b21aad0437fb51dc620dfdd3
Author:     Oliver Neukum <[EMAIL PROTECTED]>
AuthorDate: Wed Jun 13 18:50:41 2007 +0200
Committer:  Greg Kroah-Hartman <[EMAIL PROTECTED]>
CommitDate: Mon Jun 25 23:38:06 2007 -0700

    USB: fix race leading to use after free in io_edgeport
    usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
    be freed without waiting for the completion handler. This patch switches
    to usb_kill_urb(), which is synchronous.
    Thanks to Alan for making me look at the remaining users of usb_unlink_urb()
    Signed-off-by: Oliver Neukum <[EMAIL PROTECTED]>
    Signed-off-by: Al Borchers <[EMAIL PROTECTED]>
    Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
 drivers/usb/serial/io_edgeport.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 4807f96..056e192 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -3046,11 +3046,11 @@ static void edge_shutdown (struct usb_serial *serial)
        /* free up our endpoint stuff */
        if (edge_serial->is_epic) {
-               usb_unlink_urb(edge_serial->interrupt_read_urb);
+               usb_kill_urb(edge_serial->interrupt_read_urb);
-               usb_unlink_urb(edge_serial->read_urb);
+               usb_kill_urb(edge_serial->read_urb);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to