diff options
| author | Sarah Sharp <sarah.a.sharp@linux.intel.com> | 2009-08-27 14:36:14 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-10-05 09:32:50 -0700 |
| commit | 851834e4a2bd1015b05b201aff79adb643d97f10 (patch) | |
| tree | ffb4ad18dd4f07d47ee13a097ca18ad1deec8f69 | |
| parent | 9fa7825a00bb88d022a22d914646a1ce5e3ee5e0 (diff) | |
USB: xhci: Don't touch xhci_td after it's freed.
commit 9191eee7b8a0e18c07c06d6da502706805cab6d2 upstream.
On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver. Don't touch urb->td after it's freed. This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/usb/host/xhci-ring.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 2eadf069386..4142c04b5ad 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1193,7 +1193,7 @@ cleanup: if (urb) { usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb); xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n", - urb, td->urb->actual_length, status); + urb, urb->actual_length, status); spin_unlock(&xhci->lock); usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status); spin_lock(&xhci->lock); |