[PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata()

[Junzhe Li <ginger.jzllee@gmail.com>]

In yurex_disconnect(), usb_set_intfdata(interface, NULL) was called 
before usb_deregister_dev(interface, &yurex_class).
This opens a race window with usb_open() in the USB core:

  T0 (yurex_disconnect)               T1 (usb_open)
  --------------------------           -------------------------
  usb_set_intfdata(iface, NULL) [t0]
                                       fops = usb_minors[minor]  [t1]
                                       /* fops still valid here */
  usb_deregister_dev()
    usb_minors[minor] = NULL   [t2]
                                       file->f_op->open(inode, file)
                                         yurex_open()
                                           dev = usb_get_intfdata() [t3]
                                           /* dev is NULL! */

Because t0 precedes t1 precedes t2 precedes t3, T1 can obtain the
file_operations pointer for the device (t1, while the minor is still
registered), then continue into yurex_open() where it calls
usb_get_intfdata() and gets NULL back, leading to a NULL dereference.

Fix the race by calling usb_deregister_dev() first, which removes the
device from usb_minors[] before the interface data pointer is cleared.
Any concurrent usb_open() that arrives after usb_deregister_dev()
returns will fail to look up the fops and will never reach yurex_open().

Reported-by: Junzhe Li <ginger.jzllee@gmail.com>
Closes: https://lore.kernel.org/linux-usb/2026042718-unwieldy-dicing-626f@gregkh
Signed-off-by: Junzhe Li <ginger.jzllee@gmail.com>
---
 drivers/usb/misc/yurex.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 7a482cdee1e9..136272ac24ba 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -310,11 +310,12 @@ static void yurex_disconnect(struct usb_interface *interface)
 	int minor = interface->minor;
 
 	dev = usb_get_intfdata(interface);
-	usb_set_intfdata(interface, NULL);
 
 	/* give back our minor */
 	usb_deregister_dev(interface, &yurex_class);
 
+	usb_set_intfdata(interface, NULL);
+
 	/* prevent more I/O from starting */
 	usb_poison_urb(dev->urb);
 	usb_poison_urb(dev->cntl_urb);
-- 
2.34.1