Unverified Commit d1efa173 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12339 CVE-2023-52855 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5DHK6S4ESPLKHOTUO35G656AOFZ6Q6MT/ 
Jia-Ju Bai (1):
  usb: dwc2: fix possible NULL pointer dereference caused by driver
    concurrency


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9RFRD 
 
Link:https://gitee.com/openeuler/kernel/pulls/12339

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents a795c870 5f47f34a

drivers/usb/dwc2/hcd.c

+1 −1
Original line number Diff line number Diff line
@@ -4684,8 +4684,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, 
	if (qh_allocated && qh->channel && qh->channel->qh == qh)

		qh->channel->qh = NULL;

fail2:

	spin_unlock_irqrestore(&hsotg->lock, flags);

	urb->hcpriv = NULL;

	spin_unlock_irqrestore(&hsotg->lock, flags);

	kfree(qtd);

fail1:

	if (qh_allocated) {