[PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

[PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

[Muhammad Bilal]

The vub300 driver arms inactivity_timer during probe and acquires a kref
reference for the running timer. However, vub300_disconnect() sets
vub300->interface = NULL and drops the driver's kref without shutting down
the timer via timer_shutdown_sync().

If the timer expires after the host is removed and vub300 is freed,
or if concurrent work items re-arm the timer,
vub300_inactivity_timer_expired() accesses the already freed vub300
structure, causing a Use-After-Free.

Fix this by explicitly shutting down inactivity_timer via
timer_shutdown_sync() and releasing the timer's kref reference in
vub300_disconnect() and probe error cleanup paths.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/mmc/host/vub300.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 8e45dc1a4a12..9f84bd1531e2 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2350,6 +2350,8 @@ static int vub300_probe(struct usb_interface *interface,
 
 err_stop_io:
 	vub300->interface = NULL;
+	timer_shutdown_sync(&vub300->inactivity_timer);
+	kref_put(&vub300->kref, vub300_delete);
 	kref_put(&vub300->kref, vub300_delete);
 
 	return retval;
@@ -2385,6 +2387,8 @@ static void vub300_disconnect(struct usb_interface *interface)
 			usb_set_intfdata(interface, NULL);
 			/* prevent more I/O from starting */
 			vub300->interface = NULL;
+			timer_shutdown_sync(&vub300->inactivity_timer);
+			kref_put(&vub300->kref, vub300_delete);
 			mmc_remove_host(mmc);
 			kref_put(&vub300->kref, vub300_delete);
 			pr_info("USB vub300 remote SDIO host controller[%d]"
-- 
2.43.0