Skip to content

Commit 37bb562

Browse files
Dan Carpenterjhovold
authored andcommitted
USB: serial: io_edgeport: fix use after free in debug printk
The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue. Fixes: 984f686 ("USB: serial: io_edgeport.c: remove dbg() usage") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Johan Hovold <johan@kernel.org>
1 parent 3b05949 commit 37bb562

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

drivers/usb/serial/io_edgeport.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -770,11 +770,12 @@ static void edge_bulk_out_data_callback(struct urb *urb)
770770
static void edge_bulk_out_cmd_callback(struct urb *urb)
771771
{
772772
struct edgeport_port *edge_port = urb->context;
773+
struct device *dev = &urb->dev->dev;
773774
int status = urb->status;
774775

775776
atomic_dec(&CmdUrbs);
776-
dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n",
777-
__func__, urb, atomic_read(&CmdUrbs));
777+
dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb,
778+
atomic_read(&CmdUrbs));
778779

779780

780781
/* clean up the transfer buffer */
@@ -784,8 +785,7 @@ static void edge_bulk_out_cmd_callback(struct urb *urb)
784785
usb_free_urb(urb);
785786

786787
if (status) {
787-
dev_dbg(&urb->dev->dev,
788-
"%s - nonzero write bulk status received: %d\n",
788+
dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
789789
__func__, status);
790790
return;
791791
}

0 commit comments

Comments
 (0)