[PATCH 2/2] media: gspca: konica: clear the cached data URB on stream start

[Wang Xiong]

sd_isoc_irq() keeps a completed data URB in last_data_urb until a
status URB arrives.  Stopping a stream kills and frees all transfer
URBs, but does not clear this cached pointer.

When streaming starts again, a status completion can therefore use
the old pointer before any new data completion has replaced it.
The start_frame comparison then reads a freed URB.  Archived KASAN
reports identify sd_start() as the allocator, destroy_urbs() as the
free path, and this comparison as the invalid access.

Clear last_data_urb at the beginning of sd_start(), before allocating
or submitting the new stream's URBs.  All completions from the
previous stream have been drained by destroy_urbs(), so the cached
pointer cannot be reintroduced by an old completion at this point.

Tool disclosure: OpenAI Codex assisted with static analysis, the code
change and this message.  It was asked to compare archived URB
allocation, release and callback stacks and prepare a minimal fix.

Signed-off-by: Wang Xiong <20221010117@xxxxxxxxxxxxxxx>
---
 drivers/media/usb/gspca/konica.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
index 017266d73..f43a47c77 100644
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -173,6 +173,9 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	struct usb_host_interface *alt;
 	struct usb_interface *intf;
 
+	/* The previous stream's URBs have been destroyed. */
+	sd->last_data_urb = NULL;
+
 	intf = usb_ifnum_to_if(sd->gspca_dev.dev, sd->gspca_dev.iface);
 	alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
 	if (!alt) {
-- 
2.47.3