Files
linux/drivers
Andreas Noever b20909f107 thunderbolt: Fix double free of drom buffer
commit 2ffa9a5d76 upstream.

If tb_drom_read() fails, sw->drom is freed but not set to NULL.  sw->drom
is then freed again in the error path of tb_switch_alloc().

The bug can be triggered by unplugging a thunderbolt device shortly after
it is detected by the thunderbolt driver.

Clear sw->drom if tb_drom_read() fails.

[bhelgaas: add Fixes:, stable versions of interest]
Fixes: 343fcb8c70 ("thunderbolt: Fix nontrivial endpoint devices.")
Signed-off-by: Andreas Noever <andreas.noever@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-01 12:15:53 -07:00
..
2015-10-12 19:56:27 -07:00
2015-10-02 11:05:58 +09:00
2016-05-04 14:48:54 -07:00
2016-05-11 11:21:13 +02:00
2015-11-08 16:24:43 -05:00
2016-03-09 15:34:50 -08:00