Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04519854 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

usblp: poison URBs upon disconnect 



[ Upstream commit 296a193b06120aa6ae7cf5c0d7b5e5b55968026e ]

syzkaller reported an URB that should have been killed to be active.
We do not understand it, but this should fix the issue if it is real.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Reported-by: default avatar <syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/20200507085806.5793-1-oneukum@suse.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent aba4a507

drivers/usb/class/usblp.c

+4 −1
Original line number Diff line number Diff line
@@ -468,7 +468,8 @@ static int usblp_release(struct inode *inode, struct file *file) 
	usb_autopm_put_interface(usblp->intf);



	if (!usblp->present)		/* finish cleanup from disconnect */

		usblp_cleanup(usblp);

		usblp_cleanup(usblp);	/* any URBs must be dead */



	mutex_unlock(&usblp_mutex);

	return 0;

}
@@ -1375,9 +1376,11 @@ static void usblp_disconnect(struct usb_interface *intf) 


	usblp_unlink_urbs(usblp);

	mutex_unlock(&usblp->mut);

	usb_poison_anchored_urbs(&usblp->urbs);



	if (!usblp->used)

		usblp_cleanup(usblp);



	mutex_unlock(&usblp_mutex);

}