From 1fef1fae05d3431ac46169720ab4aa0fbab00d4e Mon Sep 17 00:00:00 2001 From: Yue Wang Date: Mon, 10 Sep 2018 15:04:25 +0800 Subject: [PATCH] kasan: fix bug report in xhci driver PD#172700 KASAN found a use-after-free in xhci_free_virt_device+0x220/0x270 where xhci_free_virt_device() sets slot id to 0 if udev exists: if (dev->udev && dev->udev->slot_id) dev->udev->slot_id = 0; dev->udev will be true even if udev is freed because dev->udev is not set to NULL. set dev->udev pointer to NULL in xhci_free_dev() The original patch went to stable so this fix needs to be applied there as well. Change-Id: I552b245ac7a047d8190a59bd18876cd650f289a1 Signed-off-by: Yue Wang --- drivers/usb/host/xhci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 7d33e3103e83..a8f15267d42b 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3637,6 +3637,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); } +#ifdef CONFIG_AMLOGIC_USB + virt_dev->udev = NULL; +#endif + spin_lock_irqsave(&xhci->lock, flags); /* Don't disable the slot if the host controller is dead. */ state = readl(&xhci->op_regs->status);