diff options
author | Alan Stern <stern@rowland.harvard.edu> | 2009-04-16 15:37:28 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-04-23 14:15:28 -0700 |
commit | 82a10a81c853be3859b3d222db0f372ee8d2eaa2 (patch) | |
tree | 717c7bdc51f849982a850b6fbbdbf1af36cf88d0 /drivers/usb/core/buffer.c | |
parent | c065c60e83c006611caed23d1320450fcd709398 (diff) |
USB: g_file_storage: fix use-after-free bug when closing files
This patch (as1231) fixes a use-after-free bug in g_file_storage. A
device's name may not be available after the device is unregistered,
even if the device structure itself is still allocated. Since
close_backing_file() prints a LUN's name for debugging, it shouldn't
be called after the LUN has been unregistered.
That whole area needed to be cleaned up; the backing files were
getting closed in a couple of different places. The patch fixes
things so that they get closed in just one place, as part of the
unbind procedure, immediately before the LUN is unregistered.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/core/buffer.c')
0 files changed, 0 insertions, 0 deletions