USB: usblp: fix use-after-free on disconnect
authorJohan Hovold <johan@kernel.org>
Tue, 15 Oct 2019 17:55:22 +0000 (19:55 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 29 Oct 2019 08:15:17 +0000 (09:15 +0100)
commite5e48d279fce3d6536b0f70c786f7e98d8f84e1c
tree0c98b4e3ebee903322368950f1c185a05dc6a713
parent1b64bc2abc569640e65ab9792850254f46025f5b
USB: usblp: fix use-after-free on disconnect

commit 7a759197974894213621aa65f0571b51904733d6 upstream.

A recent commit addressing a runtime PM use-count regression, introduced
a use-after-free by not making sure we held a reference to the struct
usb_interface for the lifetime of the driver data.

Fixes: 9a31535859bf ("USB: usblp: fix runtime PM after driver unbind")
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+cd24df4d075c319ebfc5@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191015175522.18490-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/class/usblp.c