From a1fdbe5bb21923e1e8f73d2ffbd474aa82096c2a Mon Sep 17 00:00:00 2001 From: Murai Takashi Date: Mon, 9 Jan 2017 05:37:34 +0900 Subject: [PATCH] usb_modeswitch.cpp: fix use after free. Signed-off-by: Adrien Destugues Fixes #13185 --- src/add-ons/kernel/drivers/common/usb_modeswitch.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp b/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp index 5c03ab4a3a..8638076818 100644 --- a/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp +++ b/src/add-ons/kernel/drivers/common/usb_modeswitch.cpp @@ -531,11 +531,13 @@ my_device_added(usb_device newDevice, void **cookie) mutex_init(&device->lock, DRIVER_NAME " device lock"); - device->notify = create_sem(0, DRIVER_NAME " callback notify"); - if (device->notify < B_OK) { + sem_id id = create_sem(0, DRIVER_NAME " callback notify"); + if (id < B_OK) { mutex_destroy(&device->lock); free(device); - return device->notify; + return id; + } else { + device->notify = id; } mutex_lock(&gDeviceListLock);