kasan: fix bug report in xhci driver
authorYue Wang <yue.wang@amlogic.com>
Mon, 10 Sep 2018 07:04:25 +0000 (15:04 +0800)
committerJianxin Pan <jianxin.pan@amlogic.com>
Wed, 12 Sep 2018 05:47:14 +0000 (22:47 -0700)
commit1fef1fae05d3431ac46169720ab4aa0fbab00d4e
tree5280420342993619a023d4197fc4be28ebbac8d5
parentc0a7f4010b3c9acd49303bb6b013ebaa58f9e921
kasan: fix bug report in xhci driver

PD#172700

KASAN found a use-after-free in xhci_free_virt_device+0x220/0x270
where xhci_free_virt_device() sets slot id to 0 if udev exists:
if (dev->udev && dev->udev->slot_id)
dev->udev->slot_id = 0;

dev->udev will be true even if udev is freed because dev->udev is
not set to NULL.

set dev->udev pointer to NULL in xhci_free_dev()

The original patch went to stable so this fix needs to be applied
there as well.

Change-Id: I552b245ac7a047d8190a59bd18876cd650f289a1
Signed-off-by: Yue Wang <yue.wang@amlogic.com>
drivers/usb/host/xhci.c