diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2010-10-26 05:16:32 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-12-29 08:16:30 -0200 |
| commit | 2661da47daefd4f22f9fdc7e9294a1cb9edf515b (patch) | |
| tree | 0a2e8731304e7637abc6bf4716ec8568a7e958ab | |
| parent | 314b3e0881c6acb4f40e07565ac1a7798c7698a3 (diff) | |
| download | kernel_samsung_crespo-2661da47daefd4f22f9fdc7e9294a1cb9edf515b.zip kernel_samsung_crespo-2661da47daefd4f22f9fdc7e9294a1cb9edf515b.tar.gz kernel_samsung_crespo-2661da47daefd4f22f9fdc7e9294a1cb9edf515b.tar.bz2 | |
[media] gspca: only set gspca->int_urb if submitting it succeeds
Currently alloc_and_submit_int_urb() is setting gspca->int_urb
as soon as the allocation has succeeded, but if the subsequent
submit fails, the urb gets destroyed. And then later will
get destroyed again in gspca_input_destroy_urb() because
gspca->int_urb is set, leading to a double free.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/video/gspca/gspca.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c index dbd63c5..a089fca 100644 --- a/drivers/media/video/gspca/gspca.c +++ b/drivers/media/video/gspca/gspca.c @@ -224,12 +224,12 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev, buffer, buffer_len, int_irq, (void *)gspca_dev, interval); urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; - gspca_dev->int_urb = urb; ret = usb_submit_urb(urb, GFP_KERNEL); if (ret < 0) { PDEBUG(D_ERR, "submit int URB failed with error %i", ret); goto error_submit; } + gspca_dev->int_urb = urb; return ret; error_submit: |