USB: host: hub: Make sure to remove dangling pointers
When the call to usb_new_device() in usb_hub_port_connect_change()
fails and corresponding USB device is freed with usb_free_device(), we
need to make sure that the pointer to it stored in dev->children[port]
is removed as well, lest we risk usage-after-free.

This issue was observed when working with a device for which
usb_set_address() would fail and trying to do "usb" right afterwards.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
1 parent 06e9ae9 commit dfed7570472031463f11489a762fdddbc5162aea
@Andrey Smirnov Andrey Smirnov authored on 29 Aug 2018
Sascha Hauer committed on 29 Aug 2018
Showing 1 changed file
View
drivers/usb/core/hub.c