usblp: poison URBs upon disconnect

[ Upstream commit 296a193b06120aa6ae7cf5c0d7b5e5b55968026e ]

syzkaller reported an URB that should have been killed to be active.
We do not understand it, but this should fix the issue if it is real.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20200507085806.5793-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 0d8e3f3804a3f87e8d8a29442f2db0a50c621ac7..084c48c5848fc90354216254ffbd48c17a7be030 100644 (file)
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -468,7 +468,8 @@ static int usblp_release(struct inode *inode, struct file *file)
        usb_autopm_put_interface(usblp->intf);
 
        if (!usblp->present)            /* finish cleanup from disconnect */
-               usblp_cleanup(usblp);
+               usblp_cleanup(usblp);   /* any URBs must be dead */
+
        mutex_unlock(&usblp_mutex);
        return 0;
 }
@@ -1375,9 +1376,11 @@ static void usblp_disconnect(struct usb_interface *intf)
 
        usblp_unlink_urbs(usblp);
        mutex_unlock(&usblp->mut);
+       usb_poison_anchored_urbs(&usblp->urbs);
 
        if (!usblp->used)
                usblp_cleanup(usblp);
+
        mutex_unlock(&usblp_mutex);
 }