patch "staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf" added to staging-linus

This is a note to let you know that I've just added the patch titled

    staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From af4b54a2e5ba18259ff9aac445bf546dd60d037e Mon Sep 17 00:00:00 2001
From: Ian Abbott <[email protected]>
Date: Mon, 15 Apr 2019 12:43:02 +0100
Subject: staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf

ni6501_alloc_usb_buffers() is called from ni6501_auto_attach() to allocate RX and TX buffers for USB transfers. It allocates devpriv->usb_rx_buf followed by devpriv->usb_tx_buf. If the allocation of devpriv->usb_tx_buf fails, it frees devpriv->usb_rx_buf, leaving the pointer set dangling, and returns an error. Later, ni6501_detach() will be called from the core comedi module code to clean up. ni6501_detach() also frees both devpriv->usb_rx_buf and devpriv->usb_tx_buf, but devpriv->usb_rx_buf may have already beed freed, leading to a double-free error. Fix it bu removing the call to kfree(devpriv->usb_rx_buf) from ni6501_alloc_usb_buffers(), relying on ni6501_detach() to free the memory.

---
 drivers/staging/comedi/drivers/ni_usb6501.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index ed5e42655821..1bb1cb651349 100644
@@ -463,10 +463,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev)
 
 	size = usb_endpoint_maxp(devpriv->ep_tx);
 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-	if (!devpriv->usb_tx_buf) {
-		kfree(devpriv->usb_rx_buf);
+	if (!devpriv->usb_tx_buf)
 		return -ENOMEM;
-	}
 
 	return 0;
 }

2.21.0