usb: usbip: set buffer pointers to NULL after free
authorMichael Grzeschik <m.grzeschik@pengutronix.de>
Mon, 22 May 2017 11:02:44 +0000 (13:02 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 13 Jun 2017 08:48:24 +0000 (10:48 +0200)
commitb3b51417d0af63fb9a06662dc292200aed9ea53f
tree4f51af5a0ad49953f0fa71f69b1837f15b84aa2a
parentc01b244ad848ac7f0faa141182db80650a8a761a
usb: usbip: set buffer pointers to NULL after free

The usbip stack dynamically allocates the transfer_buffer and
setup_packet of each urb that got generated by the tcp to usb stub code.
As these pointers are always used only once we will set them to NULL
after use. This is done likewise to the free_urb code in vudc_dev.c.
This patch fixes double kfree situations where the usbip remote side
added the URB_FREE_BUFFER.

Cc: stable@vger.kernel.org
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/usbip/stub_main.c
drivers/usb/usbip/stub_tx.c