On Tue, Mar 23, 2021 at 02:28:54AM -0700, Lv Yunlong wrote:
> In usbtmc_disconnect, data is got from intf with the initial reference.
> There is no refcount inc operation before usbmc_free_int(data). In
> usbmc_free_int(data), the data may be freed.
>
> But later in usbtmc_disconnect, there is
In usbtmc_disconnect, data is got from intf with the initial reference.
There is no refcount inc operation before usbmc_free_int(data). In
usbmc_free_int(data), the data may be freed.
But later in usbtmc_disconnect, there is another put function of data.
It could cause errors in race.
My patch
2 matches
Mail list logo
