staging: line6: use after free bug requesting version

Quoted 1 line

On Wed, Dec 5, 2012 at 7:44 PM, Dan Carpenter <[email protected]>

Quoted 36 lines

drivers/staging/line6/driver.c struct message { · line 115

Quoted 12 lines

(quoted diff) +0 -0

b/drivers/staging/line6/driver.c index 8a5d89e..884e0d8 100644

drivers/staging/line6/driver.c +1 -1

@@ -110,7 +110,7 @@ struct message {
 
 */
 static void line6_data_received(struct urb *urb);
 static int line6_send_raw_message_async_part(struct message *msg,
 
-                                            struct urb *urb);
+                                            struct urb *urb, int free);

s/int/bool/

Quoted 5 lines

drivers/staging/line6/driver.c +0 -0

 /*

Start to listen on endpoint.

drivers/staging/line6/driver.c static void line6_async_request_sent(struct urb · line 227

Quoted 10 lines

drivers/staging/line6/driver.c +2 -1

@@ -219,24 +219,42 @@ static void line6_async_request_sent(struct urb
 *urb)
 
                usb_free_urb(urb);
                kfree(msg);
 
        } else
 
-               line6_send_raw_message_async_part(msg, urb);
+               line6_send_raw_message_async_part(msg, urb, 0);
+}

I'd add a bool free_buffer field to struct message and simply modify line6_async_request_sent() to do:

if (msg->free_buffer)

Quoted 6 lines

         kfree(msg->buffer);

Then you don't need line6_async_request_sent_free_buffer() and line6_send_raw_message_async_part() doesn't need to take a bool free argument since struct message already contains that information. It would make the code simpler.

Yeah. That's true. I'll redo it.