diff options
| author | Kautuk Consul <consul.kautuk@gmail.com> | 2011-09-19 16:53:12 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-11 09:35:17 -0800 |
| commit | fb71face21504aaf924e6084abee9512bb1f2f29 (patch) | |
| tree | b5fad542ee38ad43fcd99a3c83c993c17b863d22 /drivers/usb/host/xhci-ring.c | |
| parent | 21f25cdb9e476c64d504981133d0552f7d155805 (diff) | |
| download | kernel_samsung_smdk4412-fb71face21504aaf924e6084abee9512bb1f2f29.zip kernel_samsung_smdk4412-fb71face21504aaf924e6084abee9512bb1f2f29.tar.gz kernel_samsung_smdk4412-fb71face21504aaf924e6084abee9512bb1f2f29.tar.bz2 | |
xhci-mem.c: Check for ring->first_seg != NULL
commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream.
There are 2 situations wherein the xhci_ring* might not get freed:
- When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and
we goto the fail: label in xhci_ring_alloc. In this case, the ring
will not get kfreed.
- When the num_segs argument to xhci_ring_alloc is passed as 0 and
we try to free the rung after that.
( This doesn't really happen as of now in the code but we seem to
be entertaining num_segs=0 in xhci_ring_alloc )
This should be backported to kernels as old as 2.6.31.
Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/host/xhci-ring.c')
0 files changed, 0 insertions, 0 deletions