]> git.ipfire.org Git - thirdparty/linux.git/commit
USB: iowarrior: fix use-after-free on disconnect
authorJohan Hovold <johan@kernel.org>
Sat, 23 May 2026 17:05:23 +0000 (19:05 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Jun 2026 14:14:23 +0000 (15:14 +0100)
commitbc0e4f16c44e50daa0b1ea729934baa3b4815dee
treebfb76f14d986525b665ec14e2175ac99ef061806
parent3137b243c93982fe3460335e12f9247739766e10
USB: iowarrior: fix use-after-free on disconnect

Submitted write URBs are not stopped on close() and therefore need to be
stopped unconditionally on disconnect() to avoid use-after-free in the
completion handler.

Fixes: b5f8d46867ca ("USB: iowarrior: fix use-after-free after driver unbind")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Reported-by: syzbot+ad2aac2febc3bedf0962@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a0ce39b.170a0220.39a13.0007.GAE@google.com/
Cc: stable <stable@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260523170523.1074563-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/misc/iowarrior.c