It looks like a host (like ohci or whatever) could try to allocate a new
usb_device structure with usb_alloc_dev and get back a valid pointer even if
the allocation of its private data failed. I first saw this in the 2.4
sources, but it looks like 2.6 has the same problem. This patch attempts to
fix it by freeing dev if the ->allocate() routine fails, and then returns
NULL instead of a potentially dangerous dev pointer.
Signed-off-by: Jesse Barnes <[email protected]>
Thanks,
Jesse
On Mon, Sep 27, 2004 at 03:17:32PM -0700, Jesse Barnes wrote:
> It looks like a host (like ohci or whatever) could try to allocate a new
> usb_device structure with usb_alloc_dev and get back a valid pointer even if
> the allocation of its private data failed. I first saw this in the 2.4
> sources, but it looks like 2.6 has the same problem. This patch attempts to
> fix it by freeing dev if the ->allocate() routine fails, and then returns
> NULL instead of a potentially dangerous dev pointer.
>
> Signed-off-by: Jesse Barnes <[email protected]>
Applied, thanks.
greg k-h