usb: hcd: Fix use after free in usb_hcd_pci_remove()
authorAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Fri, 14 Aug 2020 18:22:18 +0000 (21:22 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 18 Aug 2020 10:09:52 +0000 (12:09 +0200)
commit7b2816dd293031b9dec476d7853c099dc2ec9172
tree0faaba5f81d2736abc89e76d99c61a45fe3765c3
parentbed97b30968ba354035a020989df0623e52b5536
usb: hcd: Fix use after free in usb_hcd_pci_remove()

On the removal stage we put a reference to the controller structure and
if it's not used anymore it gets freed, but later we try to dereference
a pointer to a member of that structure.

Copy necessary field to a temporary variable to avoid use after free.

Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices")
Reported-by: John Garry <john.garry@huawei.com>
Link: https://lore.kernel.org/linux-usb/30a8c4ca-64c2-863b-cfcd-0970599c0ba3@huawei.com/
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20200814182218.71957-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/hcd-pci.c