[PATCH] USB: serial: garmin_gps: explicitly stop read urb on unbind

[Johan Hovold <johan@kernel.org>]

The garmin_gps read URB may be submitted from the interrupt URB
completion handler and should therefore be stopped after stopping the
interrupt URB and before freeing the port data during port unbind.

When a USB serial device is disconnected (or unbound through sysfs),
USB serial core stops and poisons the port URBs before unbinding the
port however so there is no risk for a use-after-free in the read URB
completion handler even if the driver does not stop it in its remove()
callback.

Stop the read URB explicitly for consistency, to avoid relying on core
and to prevent false positive reports from LLMs.

Note that this was erroneously flagged as a use-after-free by Sashiko.

Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/garmin_gps.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 8020149f5658..1853dc8a747d 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1402,6 +1402,7 @@ static void garmin_port_remove(struct usb_serial_port *port)
 
 	usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
 	usb_kill_urb(port->interrupt_in_urb);
+	usb_kill_urb(port->read_urb);
 	timer_shutdown_sync(&garmin_data_p->timer);
 	kfree(garmin_data_p);
 }
-- 
2.55.0