diff options
| author | Xinming Hu <huxm@marvell.com> | 2017-05-23 07:12:31 +0000 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2017-05-31 16:54:08 +0300 |
| commit | 42d1abb50ffc51c65e9cec735c8a9711296a05f7 (patch) | |
| tree | 1ab564d6493d36619e988c542a04f3c5b742e992 /drivers/net/wireless/marvell/mwifiex/usb.c | |
| parent | f4c5d5991590c4f640d5de245047444bf11f69d2 (diff) | |
mwifiex: usb: kill urb before free its memory
we have observed host system hang when device firmware crash,
stack trace show it was an use-after-free case: previous submitted
urb will be holding in usbcore, and given back to device driver
when device disconnected, while the urb have been freed in usb
device disconnect handler. This patch kill the holding urb before
free its memory.
Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/usb.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/usb.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c index debd6216366a..9c3d654ae009 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -363,6 +363,7 @@ static void mwifiex_usb_free(struct usb_card_rec *card) for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) { port = &card->port[i]; for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) { + usb_kill_urb(port->tx_data_list[j].urb); usb_free_urb(port->tx_data_list[j].urb); port->tx_data_list[j].urb = NULL; } |