brcmfmac: kill URB when request timed out
authorMathy Vanhoef <vanhoefm@gmail.com>
Thu, 13 Nov 2014 02:33:34 +0000 (21:33 -0500)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 17 Nov 2014 20:04:04 +0000 (15:04 -0500)
commit8180bd47b043507568056f74f69b6a5abea26514
treee58236b802800f7013139d29ee17d534fc6180c4
parentdaad1660285a967b5da363e8de264e86b4a496a0
brcmfmac: kill URB when request timed out

Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This
assures the URB is never submitted twice. It also prevents a possible
use-after-free of the URB transfer buffer if a timeout occurs.

Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/brcm80211/brcmfmac/usb.c