Unverified Commit 5aec215a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14080 USB: serial: io_edgeport: fix use after free in debug printk 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7BACKCOO4GGGCNT2CNEKV5PCA2JR7A3Z/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB5AVJ 
 
Link:https://gitee.com/openeuler/kernel/pulls/14080

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 482f29ee 107da700

drivers/usb/serial/io_edgeport.c

+4 −4
Original line number Diff line number Diff line
@@ -846,11 +846,12 @@ static void edge_bulk_out_data_callback(struct urb *urb) 
static void edge_bulk_out_cmd_callback(struct urb *urb)

{

	struct edgeport_port *edge_port = urb->context;

	struct device *dev = &urb->dev->dev;

	int status = urb->status;



	atomic_dec(&CmdUrbs);

	dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n",

		__func__, urb, atomic_read(&CmdUrbs));

	dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb,

		atomic_read(&CmdUrbs));





	/* clean up the transfer buffer */
@@ -860,8 +861,7 @@ static void edge_bulk_out_cmd_callback(struct urb *urb) 
	usb_free_urb(urb);



	if (status) {

		dev_dbg(&urb->dev->dev,

			"%s - nonzero write bulk status received: %d\n",

		dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",

			__func__, status);

		return;

	}