urb->hcpriv != NULL is used to indicate that the URB is queued [1]. Also see __usb_hcd_giveback_urb() and usb_hcd_submit_urb() for the reference.
In this code path, the URB is actually queued and valid qh is hep->hcpriv. [1] https://lkml.org/lkml/2019/1/25/750 Fixes: 714bc5ef3eda ("musb: potential use after free") Signed-off-by: Matwey V. Kornilov <mat...@sai.msu.ru> --- drivers/usb/musb/musb_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c index b59ce9ad14ce..a60d52c7e112 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -2302,7 +2302,7 @@ static int musb_urb_enqueue( * odd, rare, error prone, but legal. */ kfree(qh); - qh = NULL; + qh = hep->hcpriv; ret = 0; } else ret = musb_schedule(musb, qh, -- 2.16.4
