ChangeSet 1.1608.24.14, 2004/02/27 12:11:31-08:00, jeffm@suse.com

[PATCH] USB: Fix for kl5kusb105 driver

I tried using the kl5kusb105 driver for a 3Com PalmConnect USB device I
had lying around.

It oopses during device detection. There is a nested loop using the same
loop counter as the outer loop - causing the code after the nested loop
is first executed to have an invalid counter. The counter is then used
as an array index, causing a NULL deref.

Fix attached.


 drivers/usb/serial/kl5kusb105.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)


diff -Nru a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
--- a/drivers/usb/serial/kl5kusb105.c	Tue Mar 16 15:06:14 2004
+++ b/drivers/usb/serial/kl5kusb105.c	Tue Mar 16 15:06:14 2004
@@ -273,6 +273,7 @@
 
 	/* allocate the private data structure */
 	for (i=0; i<serial->num_ports; i++) {
+		int j;
 		priv = kmalloc(sizeof(struct klsi_105_private),
 						   GFP_KERNEL);
 		if (!priv) {
@@ -293,10 +294,10 @@
 		usb_set_serial_port_data(serial->port[i], priv);
 
 		spin_lock_init (&priv->lock);
-		for (i=0; i<NUM_URBS; i++) {
+		for (j=0; j<NUM_URBS; j++) {
 			struct urb* urb = usb_alloc_urb(0, GFP_KERNEL);
 
-			priv->write_urb_pool[i] = urb;
+			priv->write_urb_pool[j] = urb;
 			if (urb == NULL) {
 				err("No more urbs???");
 				continue;