Skip to content
Commit e2fe154e authored by Christian Lamparter's avatar Christian Lamparter Committed by John W. Linville
Browse files

p54usb: fix nasty use after free



In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.

Signed-off-by: default avatarChristian Lamparter <chunkeey@web.de>
Tested-by: default avatarArtur Skawina <art.08.09@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 12da401e
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment