| commit | 851834e4a2bd1015b05b201aff79adb643d97f10 | |
| author | Sarah Sharp <sarah.a.sharp@linux.intel.com> | |
| Thu, 27 Aug 2009 21:36:14 +0000 (27 14:36 -0700) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 5 Oct 2009 16:32:50 +0000 (5 09:32 -0700) | ||
| tree | ffb4ad18dd4f07d47ee13a097ca18ad1deec8f69 | treesnapshot (tar.gz zip) |
| parent | 9fa7825a00bb88d022a22d914646a1ce5e3ee5e0 | commitdiff |
USB: xhci: Don't touch xhci_td after it's freed.
commit 9191eee7b8a0e18c07c06d6da502706805cab6d2 upstream.
On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver. Don't touch urb->td after it's freed. This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 9191eee7b8a0e18c07c06d6da502706805cab6d2 upstream.
On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver. Don't touch urb->td after it's freed. This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| drivers/usb/host/xhci-ring.c | diffblobblamehistory |