ChangeSet 1.1608.24.14, 2004/02/27 12:11:31-08:00, jeffm@suse.com
[PATCH] USB: Fix for kl5kusb105 driver
I tried using the kl5kusb105 driver for a 3Com PalmConnect USB device I
had lying around.
It oopses during device detection. There is a nested loop using the same
loop counter as the outer loop - causing the code after the nested loop
is first executed to have an invalid counter. The counter is then used
as an array index, causing a NULL deref.
Fix attached.
drivers/usb/serial/kl5kusb105.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff -Nru a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
--- a/drivers/usb/serial/kl5kusb105.c Tue Mar 16 15:06:14 2004
+++ b/drivers/usb/serial/kl5kusb105.c Tue Mar 16 15:06:14 2004
@@ -273,6 +273,7 @@
/* allocate the private data structure */
for (i=0; i<serial->num_ports; i++) {
+ int j;
priv = kmalloc(sizeof(struct klsi_105_private),
GFP_KERNEL);
if (!priv) {
@@ -293,10 +294,10 @@
usb_set_serial_port_data(serial->port[i], priv);
spin_lock_init (&priv->lock);
- for (i=0; i<NUM_URBS; i++) {
+ for (j=0; j<NUM_URBS; j++) {
struct urb* urb = usb_alloc_urb(0, GFP_KERNEL);
- priv->write_urb_pool[i] = urb;
+ priv->write_urb_pool[j] = urb;
if (urb == NULL) {
err("No more urbs???");
continue;