Commit d890d1a6 authored by Jeff Mahoney's avatar Jeff Mahoney Committed by Greg Kroah-Hartman

[PATCH] USB: Fix for kl5kusb105 driver

I tried using the kl5kusb105 driver for a 3Com PalmConnect USB device I
had lying around.

It oopses during device detection. There is a nested loop using the same
loop counter as the outer loop - causing the code after the nested loop
is first executed to have an invalid counter. The counter is then used
as an array index, causing a NULL deref.

Fix attached.
parent 67d27ac4
...@@ -273,6 +273,7 @@ static int klsi_105_startup (struct usb_serial *serial) ...@@ -273,6 +273,7 @@ static int klsi_105_startup (struct usb_serial *serial)
/* allocate the private data structure */ /* allocate the private data structure */
for (i=0; i<serial->num_ports; i++) { for (i=0; i<serial->num_ports; i++) {
int j;
priv = kmalloc(sizeof(struct klsi_105_private), priv = kmalloc(sizeof(struct klsi_105_private),
GFP_KERNEL); GFP_KERNEL);
if (!priv) { if (!priv) {
...@@ -293,10 +294,10 @@ static int klsi_105_startup (struct usb_serial *serial) ...@@ -293,10 +294,10 @@ static int klsi_105_startup (struct usb_serial *serial)
usb_set_serial_port_data(serial->port[i], priv); usb_set_serial_port_data(serial->port[i], priv);
spin_lock_init (&priv->lock); spin_lock_init (&priv->lock);
for (i=0; i<NUM_URBS; i++) { for (j=0; j<NUM_URBS; j++) {
struct urb* urb = usb_alloc_urb(0, GFP_KERNEL); struct urb* urb = usb_alloc_urb(0, GFP_KERNEL);
priv->write_urb_pool[i] = urb; priv->write_urb_pool[j] = urb;
if (urb == NULL) { if (urb == NULL) {
err("No more urbs???"); err("No more urbs???");
continue; continue;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment