2019-11-06 01:55:41

by Pan Bian

Subject: [PATCH 1/1] usb: dwc2: fix potential double free

The member hsotg->desc_gen_cache is assigned NULL after it is destroyed
to avoid being freed twice when the call to usb_add_hcd() fails.

Fixes: 3b5fcc9ac2f4 ("usb: dwc2: host: use kmem cache to allocate descriptors")

Signed-off-by: Pan Bian <[email protected]>
---
drivers/usb/dwc2/hcd.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 81afe553aa66..3b943352b296 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -5183,6 +5183,7 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
"unable to create dwc2 hs isoc desc cache\n");

kmem_cache_destroy(hsotg->desc_gen_cache);
+ hsotg->desc_gen_cache = NULL;

/*
* Disable descriptor dma mode since it will not be
--
2.7.4

2019-11-14 09:52:43

by Minas Harutyunyan

Subject: Re: [PATCH 1/1] usb: dwc2: fix potential double free

On 11/6/2019 5:54 AM, Pan Bian wrote:
> The member hsotg->desc_gen_cache is assigned NULL after it is destroyed
> to avoid being freed twice when the call to usb_add_hcd() fails.
>
> Fixes: 3b5fcc9ac2f4 ("usb: dwc2: host: use kmem cache to allocate descriptors")
>
> Signed-off-by: Pan Bian <[email protected]>

Acked-by: Minas Harutyunyan <[email protected]>

> ---
> drivers/usb/dwc2/hcd.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
> index 81afe553aa66..3b943352b296 100644
> --- a/drivers/usb/dwc2/hcd.c
> +++ b/drivers/usb/dwc2/hcd.c
> @@ -5183,6 +5183,7 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
> "unable to create dwc2 hs isoc desc cache\n");
>
> kmem_cache_destroy(hsotg->desc_gen_cache);
> + hsotg->desc_gen_cache = NULL;
>
> /*
> * Disable descriptor dma mode since it will not be
>