| commit | 0fe2105a1c8d0b24b5f4b5bf04fbb0087948408b | [log] [tgz] |
|---|---|---|
| author | Linux Build Service Account <lnxbuild@localhost> | Mon Jul 02 17:12:32 2018 -0700 |
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | Mon Jul 02 17:12:31 2018 -0700 |
| tree | 41584213628ceab678ce9ba32096c522dd48216c | |
| parent | a2630a6a993858830a6573f9e7f433e19e4cac90 [diff] | |
| parent | 595ce83afa282173f8aa100ec9a89567f30f2ccf [diff] |
Merge "xhci: Fix use-after-free in xhci_free_virt_device"
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 9cba037..ccad0be 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c
@@ -3661,6 +3661,7 @@ del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); } + virt_dev->udev = NULL; spin_lock_irqsave(&xhci->lock, flags); /* Don't disable the slot if the host controller is dead. */ state = readl(&xhci->op_regs->status);