Re: [PATCH 5/5] USB: yurex: fix NULL-derefs on disconnect

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, Oct 10, 2019 at 01:05:32PM +0200, Johan Hovold wrote:
> On Wed, Oct 09, 2019 at 05:38:48PM +0200, Johan Hovold wrote:
> > The driver was using its struct usb_interface pointer as an inverted
> > disconnected flag, but was setting it to NULL without making sure all
> > code paths that used it were done with it.
> > 
> > Before commit ef61eb43ada6 ("USB: yurex: Fix protection fault after
> > device removal") this included the interrupt-in completion handler, but
> > there are further accesses in dev_err and dev_dbg statements in
> > yurex_write() and the driver-data destructor (sic!).
> > 
> > Fix this by unconditionally stopping also the control URB at disconnect
> > and by using a dedicated disconnected flag.
> > 
> > Note that we need to take a reference to the struct usb_interface to
> > avoid a use-after-free in the destructor whenever the device was
> > disconnected while the character device was still open.
> > 
> > Fixes: aadd6472d904 ("USB: yurex.c: remove dbg() usage")
> > Fixes: 45714104b9e8 ("USB: yurex.c: remove err() usage")
> > Cc: stable <stable@vger.kernel.org>     # 3.5: ef61eb43ada6
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> 
> Greg, I noticed that you picked up all patches in this series except
> this last one.
> 
> Was that one purpose or by mistake?

Mistake, thanks for catching that.  Now queued up.

greg k-h