• Andreas Noever's avatar
    thunderbolt: Fix double free of drom buffer · 2ffa9a5d
    Andreas Noever authored
    If tb_drom_read() fails, sw->drom is freed but not set to NULL.  sw->drom
    is then freed again in the error path of tb_switch_alloc().
    
    The bug can be triggered by unplugging a thunderbolt device shortly after
    it is detected by the thunderbolt driver.
    
    Clear sw->drom if tb_drom_read() fails.
    
    [bhelgaas: add Fixes:, stable versions of interest]
    Fixes: 343fcb8c ("thunderbolt: Fix nontrivial endpoint devices.")
    Signed-off-by: default avatarAndreas Noever <andreas.noever@gmail.com>
    Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
    CC: stable@vger.kernel.org	# v3.17+
    CC: Lukas Wunner <lukas@wunner.de>
    2ffa9a5d
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
cap.c Loading commit data...
ctl.c Loading commit data...
ctl.h Loading commit data...
eeprom.c Loading commit data...
nhi.c Loading commit data...
nhi.h Loading commit data...
nhi_regs.h Loading commit data...
path.c Loading commit data...
switch.c Loading commit data...
tb.c Loading commit data...
tb.h Loading commit data...
tb_regs.h Loading commit data...
tunnel_pci.c Loading commit data...
tunnel_pci.h Loading commit data...