From f7ed821da13fae6c80d65f9c0dba4c926970535e Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Mon, 19 Feb 2024 13:21:44 +0100 Subject: [PATCH] usbip: get new count before dropping the old Those devices can be identical. In that case dropping the old reference first leads to a use after free. Signed-off-by: Oliver Neukum --- drivers/usb/usbip/vhci_hcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c index 82650c11e451..76f629031005 100644 --- a/drivers/usb/usbip/vhci_hcd.c +++ b/drivers/usb/usbip/vhci_hcd.c @@ -757,12 +757,13 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag switch (ctrlreq->bRequest) { case USB_REQ_SET_ADDRESS: + struct usb_device *ud = vdev->udev; /* set_address may come when a device is reset */ dev_info(dev, "SetAddress Request (%d) to port %d\n", ctrlreq->wValue, vdev->rhport); - usb_put_dev(vdev->udev); vdev->udev = usb_get_dev(urb->dev); + usb_put_dev(ud); spin_lock(&vdev->ud.lock); vdev->ud.status = VDEV_ST_USED; -- 2.43.0