From: Dan Carpenter Date: Mon, 22 Jul 2013 06:57:49 +0000 (+0300) Subject: staging: frontier: use after free in disconnect() X-Git-Tag: MMI-PSA29.97-13-9~13944^2~6 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c8145c56103099565be2e18aeac2a32f79361f3f;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git staging: frontier: use after free in disconnect() usb_alphatrack_delete() frees "dev" so we can't use it on that path. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/frontier/alphatrack.c b/drivers/staging/frontier/alphatrack.c index 5590ebf1da15..817f837b240d 100644 --- a/drivers/staging/frontier/alphatrack.c +++ b/drivers/staging/frontier/alphatrack.c @@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf) mutex_unlock(&dev->mtx); usb_alphatrack_delete(dev); } else { + atomic_set(&dev->writes_pending, 0); dev->intf = NULL; mutex_unlock(&dev->mtx); } - atomic_set(&dev->writes_pending, 0); mutex_unlock(&disconnect_mutex); dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",