usb: gadget: fix potential double-free in m66592_probe.

m66592_free_request() is called under label "err_add_udc" and "clean_up", and m66592->ep0_req is not set to NULL after first free, leading to a double-free. Fix this issue by setting m66592->ep0_req to NULL after the first free. Fixes: 0f91349 ("usb: gadget: convert all users to the new udc infrastructure") Signed-off-by: Qiushi Wu <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
chewitt · May 25, 2020 · 44734a5 · 44734a5
1 parent e5b9134
commit 44734a5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
@@ -1667,7 +1667,7 @@ static int m66592_probe(struct platform_device *pdev)
 
 err_add_udc:
 	m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
-
+	m66592->ep0_req = NULL;
 clean_up3:
 	if (m66592->pdata->on_chip) {
 		clk_disable(m66592->clk);