Commit 2661da47 authored by Hans de Goede's avatar Hans de Goede Committed by Mauro Carvalho Chehab
Browse files

[media] gspca: only set gspca->int_urb if submitting it succeeds 



Currently alloc_and_submit_int_urb() is setting gspca->int_urb
as soon as the allocation has succeeded, but if the subsequent
submit fails, the urb gets destroyed. And then later will
get destroyed again in gspca_input_destroy_urb() because
gspca->int_urb is set, leading to a double free.

Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 314b3e08

drivers/media/video/gspca/gspca.c

+1 −1
Original line number Diff line number Diff line
@@ -224,12 +224,12 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev, 
		buffer, buffer_len,

		int_irq, (void *)gspca_dev, interval);

	urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;

	gspca_dev->int_urb = urb;

	ret = usb_submit_urb(urb, GFP_KERNEL);

	if (ret < 0) {

		PDEBUG(D_ERR, "submit int URB failed with error %i", ret);

		goto error_submit;

	}

	gspca_dev->int_urb = urb;

	return ret;



error_submit: