[PATCH usb-next v1] USB: serial: keyspan: Fixing use-after-free in usa49_glocont_callback()

[PATCH usb-next v1] USB: serial: keyspan: Fixing use-after-free in usa49_glocont_callback()

[Rafael Alejandro Diaz Cruz]

usa49_glocont_callback() obtains the private data from all
ports of a serial device using usb_get_serial_port_data().
This can happen during keyspan_port_remove() which frees
the private data which can cause UAF.

Fix this by calling usb_set_serial_port_data(port, NULL)
inside keyspan_port_remove() right before kfree() of
private data. This in turn allows "if (!p_priv) continue;"
condition within usa49_glocont_callback() to execute
properly.

Reported-by: syzbot+e5e28c3e953b2eebb16e@syzkaller.appspotmail.com
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
 drivers/usb/serial/keyspan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 4d3746c7a94e..0e08acb99970 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2997,6 +2997,8 @@ static void keyspan_port_remove(struct usb_serial_port *port)
 	for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i)
 		kfree(p_priv->in_buffer[i]);
 
+	usb_set_serial_port_data(port, NULL);
+
 	kfree(p_priv);
 }
 
-- 
2.43.0