stub_priv_alloc() links a zeroed stub_priv to priv_init before the URB array is allocated. The error handler may therefore consume the object after stub_recv_cmd_submit() reports SDEV_EVENT_ERROR_MALLOC. Do not publish num_urbs until the array exists. If a later URB allocation fails, clear the freed array pointer and count before the event handler can walk them. This prevents a NULL dereference on array-allocation failure and freed-array reads that can lead to invalid URB use or a double free on later failures. Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") Cc: stable@vger.kernel.org # 5.4+ Reported-by: co+66c3f58096d0bde8@bugs.sh Closes: https://lore.kernel.org/all/J3vQPnNHSkQ6YUiFvu1bk8ai3Q8aZ7a9J1Y7%40bugs.sh/ Assisted-by: Codex:gpt-5 Signed-off-by: Weiming Shi --- drivers/usb/usbip/stub_rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c index 1e9ae578810d9..33058fb05b2f4 100644 --- a/drivers/usb/usbip/stub_rx.c +++ b/drivers/usb/usbip/stub_rx.c @@ -534,10 +534,10 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, } /* allocate urb array */ - priv->num_urbs = num_urbs; priv->urbs = kmalloc_objs(*priv->urbs, num_urbs); if (!priv->urbs) goto err_urbs; + priv->num_urbs = num_urbs; /* setup a urb */ if (support_sg) { @@ -641,6 +641,8 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, err_urb: kfree(priv->urbs); + priv->urbs = NULL; + priv->num_urbs = 0; err_urbs: kfree(buffer); sgl_free(sgl); -- 2.55.0