Shuangpeng Bai b1e24de475 USB: c67x00: fix use-after-free in c67x00_add_iso_urb() ... When TD creation fails for the last packet of an isochronous URB, c67x00_add_iso_urb() gives the URB back before updating the endpoint scheduling state. c67x00_giveback_urb() frees the URB private data, and the completion callback may release the final URB reference. The following accesses to urbp->ep_data, urb->interval, and urbp->cnt can therefore use freed memory. Update next_frame and cnt before giving back the failed final packet, making the giveback the last operation that uses the URB and its private data. Fixes: e9b29ffc51 ("USB: add Cypress c67x00 OTG controller HCD driver") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Link: https://patch.msgid.link/20260806013502.322067-1-shuangpeng.kernel@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-08-14 10:49:00 +09:00
..
c67x00-drv.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
c67x00-hcd.c	usb: c67x00: c67x00-hcd: Demote obvious misuse of kerneldoc to standard comment blocks	2020-07-15 17:25:57 +02:00
c67x00-hcd.h	USB: c67x00: Remove unused declaration c67x00_hcd_msg_received()	2023-10-02 16:42:33 +02:00
c67x00-ll-hpi.c	usb: c67x00: c67x00-ll-hpi: Demote obvious misuse of kerneldoc to standard comment blocks	2020-07-03 10:18:40 +02:00
c67x00-sched.c	USB: c67x00: fix use-after-free in c67x00_add_iso_urb()	2026-08-14 10:49:00 +09:00
c67x00.h
Makefile