Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware

[Hillf Danton <hdanton@sina.com>]

> Date: Mon, 29 Jun 2026 14:09:27 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3d5670d672ae Add linux-next specific files for 20260626
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10b76dfe580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2bb8183b2d472f18
> dashboard link: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15fa0e1c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13519391580000

#syz test

--- x/drivers/usb/atm/ueagle-atm.c
+++ y/drivers/usb/atm/ueagle-atm.c
@@ -2605,9 +2605,11 @@ static void uea_disconnect(struct usb_in
 		usbatm_usb_disconnect(intf);
 		mutex_unlock(&uea_mutex);
 		uea_info(usb, "ADSL device removed\n");
-	} else if (usb->config->desc.bNumInterfaces == 1) {
+	} else {
 		struct completion *fw_done = usb_get_intfdata(intf);
 
+		if (!fw_done)
+			return;
 		uea_dbg(usb, "pre-firmware device, waiting firmware upload\n");
 		wait_for_completion(fw_done);
 		uea_dbg(usb, "pre-firmware device, finished waiting\n");
--