Commit b41cb145 authored by Vojtech Pavlik's avatar Vojtech Pavlik Committed by Greg Kroah-Hartman

[PATCH] USB: Fix oops in usblp driver

This bug was reported back in July, and I sent out a patch but apparently
it never got to you.  The usblp driver was calling usb_buffer_free() from
usblp_cleanup(), which runs after disconnect() if a user process holds the
device open.  But once the usb_device is gone usb_buffer_free() will
oops.  The patch frees the buffers in usb_disconnect() instead.

Recently Joost Witteveen reported the same oops and found that the
patch solved it for him.  So there shouldn't be problems with accepting
it.
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarVojtech Pavlik <vojtech@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <greg@kroah.com>
parent 1ea81ccb
......@@ -397,10 +397,6 @@ static void usblp_cleanup (struct usblp *usblp)
{
info("usblp%d: removed", usblp->minor);
usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
usblp->writebuf, usblp->writeurb->transfer_dma);
usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
usblp->readbuf, usblp->readurb->transfer_dma);
kfree (usblp->device_id_string);
kfree (usblp->statusbuf);
usb_free_urb(usblp->writeurb);
......@@ -1159,6 +1155,10 @@ static void usblp_disconnect(struct usb_interface *intf)
usb_set_intfdata (intf, NULL);
usblp_unlink_urbs(usblp);
usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
usblp->writebuf, usblp->writeurb->transfer_dma);
usb_buffer_free (usblp->dev, USBLP_BUF_SIZE,
usblp->readbuf, usblp->readurb->transfer_dma);
if (!usblp->used)
usblp_cleanup (usblp);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment