Ian Abbott af4b54a2e5 staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf ... `ni6501_alloc_usb_buffers()` is called from `ni6501_auto_attach()` to allocate RX and TX buffers for USB transfers. It allocates `devpriv->usb_rx_buf` followed by `devpriv->usb_tx_buf`. If the allocation of `devpriv->usb_tx_buf` fails, it frees `devpriv->usb_rx_buf`, leaving the pointer set dangling, and returns an error. Later, `ni6501_detach()` will be called from the core comedi module code to clean up. `ni6501_detach()` also frees both `devpriv->usb_rx_buf` and `devpriv->usb_tx_buf`, but `devpriv->usb_rx_buf` may have already beed freed, leading to a double-free error. Fix it bu removing the call to `kfree(devpriv->usb_rx_buf)` from `ni6501_alloc_usb_buffers()`, relying on `ni6501_detach()` to free the memory. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-04-17 11:59:24 +02:00
..
drivers	staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf	2019-04-17 11:59:24 +02:00
kcomedilib
comedi.h	staging: comedi: clarify/unify macros for NI macro-defined terminals	2018-11-07 13:08:28 +01:00
comedi_buf.c
comedi_compat32.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
comedi_compat32.h
comedi_fops.c	staging: comedi: comedi_fops.c: Remove redundant blank line	2019-02-04 12:30:27 +01:00
comedi_internal.h
comedi_pci.c
comedi_pci.h
comedi_pcmcia.c
comedi_pcmcia.h
comedi_usb.c
comedi_usb.h
comedidev.h	staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest	2019-03-18 07:57:58 +01:00
comedilib.h
drivers.c	staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest	2019-03-18 07:57:58 +01:00
Kconfig	staging: comedi: add interface to ni routing table information	2018-10-09 15:36:04 +02:00
Makefile
proc.c
range.c
TODO