Patch "usb: usbip: set buffer pointers to NULL after free" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

usb: usbip: set buffer pointers to NULL after free

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-usbip-set-buffer-pointers-to-null-after-free.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Michael Grzeschik <[email protected]>
Date: Mon, 22 May 2017 13:02:44 +0200
Subject: usb: usbip: set buffer pointers to NULL after free

From: Michael Grzeschik <[email protected]>

commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream.

The usbip stack dynamically allocates the transfer_buffer and setup_packet of each urb that got generated by the tcp to usb stub code. As these pointers are always used only once we will set them to NULL after use. This is done likewise to the free_urb code in vudc_dev.c. This patch fixes double kfree situations where the usbip remote side added the URB_FREE_BUFFER.

---
 drivers/usb/usbip/stub_main.c |    4 ++++
 drivers/usb/usbip/stub_tx.c   |    4 ++++
 2 files changed, 8 insertions(+)

@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stu
 		kmem_cache_free(stub_priv_cache, priv);
 
 		kfree(urb->transfer_buffer);
+		urb->transfer_buffer = NULL;
+
 		kfree(urb->setup_packet);
+		urb->setup_packet = NULL;
+
 		usb_free_urb(urb);
 	}
 }

@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struc
 	struct urb *urb = priv->urb;
 
 	kfree(urb->setup_packet);
+	urb->setup_packet = NULL;
+
 	kfree(urb->transfer_buffer);
+	urb->transfer_buffer = NULL;
+
 	list_del(&priv->list);
 	kmem_cache_free(stub_priv_cache, priv);
 	usb_free_urb(urb);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usb-usbip-set-buffer-pointers-to-null-after-free.patch