usb: wusbcore: set pointers to NULL after freeing in error cases

[platform/adaptation/renesas_rcar/renesas_kernel.git] / drivers / usb / wusbcore / wa-xfer.c

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index f614fb1..0b27146 100644 (file)
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -520,6 +520,10 @@ static void wa_seg_dto_cb(struct urb *urb)
        unsigned rpipe_ready = 0;
        u8 done = 0;
 
+       /* free the sg if it was used. */
+       kfree(urb->sg);
+       urb->sg = NULL;
+
        switch (urb->status) {
        case 0:
                spin_lock_irqsave(&xfer->lock, flags);
@@ -1556,6 +1560,7 @@ error_submit_buf_in:
                        xfer, seg_idx, result);
        seg->result = result;
        kfree(wa->buf_in_urb->sg);
+       wa->buf_in_urb->sg = NULL;
 error_sg_alloc:
        __wa_xfer_abort(xfer);
 error_complete:
@@ -1855,6 +1860,7 @@ out:
 
 error_dti_urb_submit:
        usb_put_urb(wa->buf_in_urb);
+       wa->buf_in_urb = NULL;
 error_buf_in_urb_alloc:
        usb_put_urb(wa->dti_urb);
        wa->dti_urb = NULL;