mirror of
https://github.com/torvalds/linux.git
synced 2026-09-25 21:21:09 -04:00
Johan Hovold
aafb00a977
The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commitef61eb43ad("USB: yurex: Fix protection fault after device removal") this included the interrupt-in completion handler, but there are further accesses in dev_err and dev_dbg statements in yurex_write() and the driver-data destructor (sic!). Fix this by unconditionally stopping also the control URB at disconnect and by using a dedicated disconnected flag. Note that we need to take a reference to the struct usb_interface to avoid a use-after-free in the destructor whenever the device was disconnected while the character device was still open. Fixes:aadd6472d9("USB: yurex.c: remove dbg() usage") Fixes:45714104b9("USB: yurex.c: remove err() usage") Cc: stable <[email protected]> # 3.5:ef61eb43adSigned-off-by: Johan Hovold <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>