| commit | 74ac07e8b8209ba9429fa1a9afc07aa5ecef5af8 | [log] [tgz] |
|---|---|---|
| author | Oliver Neukum <oneukum@suse.de> | Wed Jun 13 18:50:41 2007 +0200 |
| committer | Greg Kroah-Hartman <gregkh@suse.de> | Mon Jun 25 23:38:06 2007 -0700 |
| tree | 113b8f6253ac3ece264c482ce16880e3ec6b2244 | |
| parent | 5afeb104e7901168b21aad0437fb51dc620dfdd3 [diff] |
USB: fix race leading to use after free in io_edgeport usb_unlink_urb() is asynchronous, therefore an URB's buffer may not be freed without waiting for the completion handler. This patch switches to usb_kill_urb(), which is synchronous. Thanks to Alan for making me look at the remaining users of usb_unlink_urb() Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Al Borchers <alborchers@steinerpoint.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>