[PATCH v2] usb: musb: Fix urb->hcpriv value

[Matwey V. Kornilov]

urb->hcpriv != NULL is used to indicate that the URB is queued [1].
Also see __usb_hcd_giveback_urb() and usb_hcd_submit_urb() for
the reference.

In this code path, the URB is actually queued and valid qh is hep->hcpriv.

[1] https://lkml.org/lkml/2019/1/25/750

Fixes: 714bc5ef3eda ("musb: potential use after free")
Signed-off-by: Matwey V. Kornilov <matwey@xxxxxxxxxx>
---
 drivers/usb/musb/musb_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index b59ce9ad14ce..a60d52c7e112 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2302,7 +2302,7 @@ static int musb_urb_enqueue(
 		 * odd, rare, error prone, but legal.
 		 */
 		kfree(qh);
-		qh = NULL;
+		qh = hep->hcpriv;
 		ret = 0;
 	} else
 		ret = musb_schedule(musb, qh,
-- 
2.16.4