Oliver Neukum 74ac07e8b8 USB: fix race leading to use after free in io_edgeport
usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()


Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2007-06-25 23:38:06 -07:00
..
2007-05-22 23:45:50 -07:00
2007-04-27 13:28:42 -07:00
2007-04-27 13:28:33 -07:00
2007-05-09 07:12:20 +02:00
2007-04-27 13:28:36 -07:00
2007-04-27 13:28:38 -07:00