While plugging / unplugging on a DWC2 host port with "slub_debug=FZPUA"
enabled, I found a crash that was quite obviously a use after free.
It appears that in some cases when we handle the various sub-cases of
HCINT we may end up freeing the QTD. If there is more than one bit set
in HCINT we may
Hi Douglas,
[auto build test WARNING on balbi-usb/next -- if it's inappropriate base,
please suggest rules for selecting the more suitable base]
url:
https://github.com/0day-ci/linux/commits/Douglas-Anderson/usb-dwc2-host-Fix-use-after-free-w-simultaneous-irqs/20151015-024824
reproduce:
