[PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure

[Cen Zhang <zzzccc427@gmail.com>]

xusbatm_capture_intf() claims a sibling interface before changing it to
the requested alternate setting. usb_driver_claim_interface() binds the
sibling interface and stores the usbatm instance as its intfdata.

If usb_set_interface() fails after that claim, xusbatm_bind() returns an
error and usbatm_usb_probe() frees the usbatm instance without calling
the mini-driver unbind callback. The sibling interface is left bound with
stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
with a freed instance.

Release the just-claimed interface when usb_set_interface() fails. This
clears intfdata before dropping the claim, matching xusbatm's existing
release helper and leaving the caller's rollback to handle any previously
captured interface.

Validation reproduced this kernel report:
KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
Workqueue: usb_hub_wq hub_event
The buggy address is located 224 bytes inside of freed 2048-byte region
[ffff888114339000, ffff888114339800)
Read of size 8
Call trace:
  dump_stack_lvl+0x66/0xa0
  print_report+0xce/0x630
  __mutex_lock+0x12a/0x1980
  srso_alias_return_thunk+0x5/0xfbef5
  __virt_addr_valid+0x188/0x320
  kasan_report+0xe0/0x110
  usbatm_usb_disconnect+0x52/0x440
  __lock_acquire+0x466/0x2260
  rcu_is_watching+0x20/0x50
  rpm_resume+0x705/0xab0
  usb_unbind_interface+0xf3/0x400
  device_release_driver_internal+0x298/0x330
  kobject_put+0x47/0x2e0 (lib/kobject.c:730)
  bus_remove_device+0x1c6/0x2d0
  device_del+0x218/0x540
  kfree+0x2f9/0x530
  kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
  usb_disable_device+0x180/0x3b0
  usb_set_configuration+0xab/0xf20
  blocking_notifier_call_chain+0x5f/0x70
  notifier_call_chain+0x60/0x1e0
  usb_unbind_device+0x40/0xe0
  __device_attach_driver+0xf1/0x1a0
  bus_for_each_drv+0xf9/0x160
  trace_hardirqs_on+0x18/0x130
  _raw_spin_unlock_irqrestore+0x44/0x60
  __device_attach+0x133/0x2a0
  do_raw_spin_unlock+0x9a/0x100
  device_add+0x9b9/0xc10
  add_device_randomness+0xb7/0xf0
  usb_new_device+0x492/0x870
  hub_event+0x1b10/0x29c0
  lock_acquire+0x187/0x300
  process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
  lock_release+0xc8/0x290
  process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
  __list_add_valid_or_report+0x37/0xf0
  worker_thread+0x2d8/0x570
  kthread+0x1ad/0x1f0
  ret_from_fork+0x3c9/0x540
  __switch_to+0x2e9/0x730

Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
 drivers/usb/atm/xusbatm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 0befbf63d1cc..a9e67aa136f3 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
 static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
 static struct usb_driver xusbatm_usb_driver;
 
+static void xusbatm_release_intf(struct usb_device *usb_dev,
+				 struct usb_interface *intf, int claimed);
+
 static struct usb_interface *xusbatm_find_intf(struct usb_device *usb_dev, int altsetting, u8 ep)
 {
 	struct usb_host_interface *alt;
@@ -62,6 +65,7 @@ static int xusbatm_capture_intf(struct usbatm_data *usbatm, struct usb_device *u
 	ret = usb_set_interface(usb_dev, ifnum, altsetting);
 	if (ret) {
 		usb_err(usbatm, "%s: altsetting %2d for interface %2d failed (%d)!\n", __func__, altsetting, ifnum, ret);
+		xusbatm_release_intf(usb_dev, intf, claim);
 		return ret;
 	}
 	return 0;
-- 
2.43.0