[PATCH] usb: host: max3421-hcd: stop SPI thread before freeing its DMA buffers

[Haotian Zhang]

In max3421_probe(), the error path frees the kmalloc'd tx and rx buffers
with kfree() before calling kthread_stop() on max3421_hcd->spi_thread.
The SPI thread entry point max3421_spi_thread() immediately starts using
those buffers through spi_rd8()/spi_wr8(), so when usb_add_hcd() or
request_irq() fails and the thread is still running, it can access the
freed buffers, giving a use-after-free.

Stop the SPI thread first and only free the tx/rx buffers afterwards.

Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@xxxxxxxxxxx>
---
 drivers/usb/host/max3421-hcd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 73e76d0e6973..f7cd3e8d8cae 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1922,10 +1922,14 @@ max3421_probe(struct spi_device *spi)
 	}
 
 	if (hcd) {
-		kfree(max3421_hcd->tx);
-		kfree(max3421_hcd->rx);
+		/*
+		 * The SPI thread uses the tx/rx buffers, so it must be
+		 * stopped before they are freed.
+		 */
 		if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
 			kthread_stop(max3421_hcd->spi_thread);
+		kfree(max3421_hcd->tx);
+		kfree(max3421_hcd->rx);
 		usb_put_hcd(hcd);
 	}
 	return retval;
-- 
2.25.1