• Tom Rix's avatar
    USB: c67x00: fix use after free in c67x00_giveback_urb · 70a6e4e9
    Tom Rix authored
    commit 211f0834 upstream.
    
    clang static analysis flags this error
    
    c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
            usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
                                                                 ^~~~~~~~~~~~
    Problem happens in this block of code
    
    	c67x00_release_urb(c67x00, urb);
    	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
    	spin_unlock(&c67x00->lock);
    	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
    
    In the call to c67x00_release_urb has this freeing of urbp
    
    	urbp = urb->hcpriv;
    	urb->hcpriv = NULL;
    	list_del(&urbp->hep_node);
    	kfree(urbp);
    
    And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd
    parameter.
    
    Since all is required is the status, pass the status directly as is
    done in c64x00_urb_dequeue
    
    Fixes: e9b29ffc ("USB: add Cypress c67x00 OTG controller HCD driver")
    Signed-off-by: default avatarTom Rix <trix@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    70a6e4e9
c67x00-sched.c 28.9 KB