patch "staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf" added to staging-linus

This is a note to let you know that I've just added the patch titled

    staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From 663d294b4768bfd89e529e069bffa544a830b5bf Mon Sep 17 00:00:00 2001
From: Ian Abbott <[email protected]>
Date: Mon, 15 Apr 2019 12:52:30 +0100
Subject: staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf

vmk80xx_alloc_usb_buffers() is called from vmk80xx_auto_attach() to allocate RX and TX buffers for USB transfers. It allocates devpriv->usb_rx_buf followed by devpriv->usb_tx_buf. If the allocation of devpriv->usb_tx_buf fails, it frees devpriv->usb_rx_buf, leaving the pointer set dangling, and returns an error. Later, vmk80xx_detach() will be called from the core comedi module code to clean up. vmk80xx_detach() also frees both devpriv->usb_rx_buf and devpriv->usb_tx_buf, but devpriv->usb_rx_buf may have already been freed, leading to a double-free error. Fix it by removing the call to kfree(devpriv->usb_rx_buf) from vmk80xx_alloc_usb_buffers(), relying on vmk80xx_detach() to free the memory.

---
 drivers/staging/comedi/drivers/vmk80xx.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index b035d662390b..65dc6c51037e 100644
@@ -682,10 +682,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
 
 	size = usb_endpoint_maxp(devpriv->ep_tx);
 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-	if (!devpriv->usb_tx_buf) {
-		kfree(devpriv->usb_rx_buf);
+	if (!devpriv->usb_tx_buf)
 		return -ENOMEM;
-	}
 
 	return 0;
 }

2.21.0