Oliver Neukum 74ac07e8b8 USB: fix race leading to use after free in io_edgeport
usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()


Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-06-25 23:38:06 -07:00
..
2007-06-23 10:57:28 -04:00
2007-06-20 19:56:21 -04:00
2007-06-03 18:08:44 -07:00
2007-06-08 12:41:08 -07:00
2007-06-16 02:24:43 +02:00
2007-06-08 17:23:33 -07:00
2007-06-02 00:48:48 -04:00
2007-06-04 17:54:09 -07:00
2007-05-21 09:18:19 -07:00
2007-05-08 13:37:51 +10:00
2007-06-20 19:12:42 -04:00
2007-06-08 17:23:33 -07:00