From: Sarah Sharp Date: Thu, 27 Aug 2009 21:36:14 +0000 (-0700) Subject: USB: xhci: Don't touch xhci_td after it's freed. X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=9191eee7b8a0e18c07c06d6da502706805cab6d2;p=openwrt%2Fstaging%2Fblogic.git USB: xhci: Don't touch xhci_td after it's freed. On a successful transfer, urb->td is freed before the URB is ready to be given back to the driver. Don't touch urb->td after it's freed. This bug would have only shown up when xHCI debugging was turned on, and the freed memory was quickly reused for something else. Signed-off-by: Sarah Sharp Cc: stable Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 2eadf0693862..4142c04b5adf 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1193,7 +1193,7 @@ cleanup: if (urb) { usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb); xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n", - urb, td->urb->actual_length, status); + urb, urb->actual_length, status); spin_unlock(&xhci->lock); usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status); spin_lock(&xhci->lock);