USB: usblp: fix use-after-free on disconnect
authorJohan Hovold <johan@kernel.org>
Tue, 15 Oct 2019 17:55:22 +0000 (19:55 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 15 Oct 2019 18:19:19 +0000 (20:19 +0200)
commit7a759197974894213621aa65f0571b51904733d6
tree697a594cd3722bddc8bc5fc77bac4e914dfc5b78
parentb987b66ac3a2bc2f7b03a0ba48a07dc553100c07
USB: usblp: fix use-after-free on disconnect

A recent commit addressing a runtime PM use-count regression, introduced
a use-after-free by not making sure we held a reference to the struct
usb_interface for the lifetime of the driver data.

Fixes: 9a31535859bf ("USB: usblp: fix runtime PM after driver unbind")
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+cd24df4d075c319ebfc5@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191015175522.18490-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/class/usblp.c