Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in raw_event_queue_add

[syzbot <syzbot+1e3edf922962b5ea40a4@syzkaller.appspotmail.com>]

> #syz test

This crash does not have a reproducer. I cannot test it.

>
> diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
> index 20165e1582d9..d7fca01afbf1 100644
> --- a/drivers/usb/gadget/legacy/raw_gadget.c
> +++ b/drivers/usb/gadget/legacy/raw_gadget.c
> @@ -120,9 +120,13 @@ static struct usb_raw_event *raw_event_queue_fetch(
>  static void raw_event_queue_destroy(struct raw_event_queue *queue)
>  {
>         int i;
> +       unsigned long flags;
>  
> +       spin_lock_irqsave(&queue->lock, flags);
>         for (i = 0; i < queue->size; i++)
>                 kfree(queue->events[i]);
> +       spin_unlock_irqrestore(&queue->lock, flags);
> +
>         queue->size = 0;
>  }
>
> Ivan Pravdin
>