]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
hwmon: (powerz) Fix use-after-free on USB disconnect
authorSanman Pradhan <psanman@juniper.net>
Fri, 10 Apr 2026 00:25:35 +0000 (00:25 +0000)
committerGuenter Roeck <linux@roeck-us.net>
Fri, 10 Apr 2026 15:28:18 +0000 (08:28 -0700)
commit08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4
treeb3f9f9e13c9996a0f1146042be340153bc33aea9
parenta2981c20ad673bcd5f0e5caa6ef103b8fcdbd6a2
hwmon: (powerz) Fix use-after-free on USB disconnect

After powerz_disconnect() frees the URB and releases the mutex, a
subsequent powerz_read() call can acquire the mutex and call
powerz_read_data(), which dereferences the freed URB pointer.

Fix by:
 - Setting priv->urb to NULL in powerz_disconnect() so that
   powerz_read_data() can detect the disconnected state.
 - Adding a !priv->urb check at the start of powerz_read_data()
   to return -ENODEV on a disconnected device.
 - Moving usb_set_intfdata() before hwmon registration so the
   disconnect handler can always find the priv pointer.

Fixes: 4381a36abdf1c ("hwmon: add POWER-Z driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260410002521.422645-2-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
drivers/hwmon/powerz.c