[PATCH] drivers/usb/class/cdc-acm.c: clear dangling pointer

[PATCH] drivers/usb/class/cdc-acm.c: clear dangling pointer

[Julia Lawall]

From: Julia Lawall <julia@diku.dk>

On some failures, the country_code field of an acm structure is freed
without freeing the acm structure itself.  Elsewhere, operations including
memcpy and kfree are performed on the country_code field.  The patch sets
the country_code field to NULL when it is freed, and likewise sets the
country_code_size field to 0.

Signed-off-by: Julia Lawall <julia@diku.dk>

---
Only compile tested.  The second goto skip_countries serves no purpose, but
is perhaps useful from a readability point of view.

 drivers/usb/class/cdc-acm.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f30fbff..9543b19 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1230,6 +1230,8 @@ made_compressed_probe:
 		i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
 		if (i < 0) {
 			kfree(acm->country_codes);
+			acm->country_codes = NULL;
+			acm->country_code_size = 0;
 			goto skip_countries;
 		}
 
@@ -1238,6 +1240,8 @@ made_compressed_probe:
 		if (i < 0) {
 			device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
 			kfree(acm->country_codes);
+			acm->country_codes = NULL;
+			acm->country_code_size = 0;
 			goto skip_countries;
 		}
 	}

Re: [PATCH] drivers/usb/class/cdc-acm.c: clear dangling pointer

[Oliver Neukum]

Am Freitag, 23. Dezember 2011, 14:02:55 schrieb Julia Lawall:
> From: Julia Lawall <julia@diku.dk>
> 
> On some failures, the country_code field of an acm structure is freed
> without freeing the acm structure itself.  Elsewhere, operations including
> memcpy and kfree are performed on the country_code field.  The patch sets
> the country_code field to NULL when it is freed, and likewise sets the
> country_code_size field to 0.
> 
> Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Oliver NEukum <oneukum@suse.de>

This is in principle oopsable and should go into stable.

	Regards
		Oliver