• Andreas Noever's avatar
    thunderbolt: Fix double free of drom buffer · 2ffa9a5d
    Andreas Noever authored
    If tb_drom_read() fails, sw->drom is freed but not set to NULL.  sw->drom
    is then freed again in the error path of tb_switch_alloc().
    
    The bug can be triggered by unplugging a thunderbolt device shortly after
    it is detected by the thunderbolt driver.
    
    Clear sw->drom if tb_drom_read() fails.
    
    [bhelgaas: add Fixes:, stable versions of interest]
    Fixes: 343fcb8c ("thunderbolt: Fix nontrivial endpoint devices.")
    Signed-off-by: default avatarAndreas Noever <andreas.noever@gmail.com>
    Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
    CC: stable@vger.kernel.org	# v3.17+
    CC: Lukas Wunner <lukas@wunner.de>
    2ffa9a5d