From c9458c6f8a8f9c8b09fef0e2a4d5798ded993ef8 Mon Sep 17 00:00:00 2001 From: Nil Yi Date: Sat, 14 Aug 2021 12:29:39 +0200 Subject: media: rc: clean the freed urb pointer to avoid double free After freed rx_urb, we should set the second interface urb to NULL, otherwise a double free would happen when the driver is removed from the first interface. Signed-off-by: Nil Yi Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/imon.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/media/rc') diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c index 2ca4e86c7b9f..54da6f60079b 100644 --- a/drivers/media/rc/imon.c +++ b/drivers/media/rc/imon.c @@ -2358,8 +2358,10 @@ urb_submit_failed: touch_setup_failed: find_endpoint_failed: usb_put_dev(ictx->usbdev_intf1); + ictx->usbdev_intf1 = NULL; mutex_unlock(&ictx->lock); usb_free_urb(rx_urb); + ictx->rx_urb_intf1 = NULL; rx_urb_alloc_failed: dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret); -- cgit v1.2.3