usb: yurex: fix race in probe

The bbu member of the descriptor must be set to the value
standing for uninitialized values before the URB whose
completion handler sets bbu is submitted. Otherwise there is
a window during which probing can overwrite already retrieved
data.

Cc: stable <stable@kernel.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260209143720.1507500-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 9189e4bb213a4a8f435f188edb9dabc980beaab7..7a482cdee1e9c2562384c261f0ec2bb541072d54 100644 (file)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -272,6 +272,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
                         dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
                         dev, 1);
        dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+       dev->bbu = -1;
        if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
                retval = -EIO;
                dev_err(&interface->dev, "Could not submitting URB\n");
@@ -280,7 +281,6 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
 
        /* save our data pointer in this interface device */
        usb_set_intfdata(interface, dev);
-       dev->bbu = -1;
 
        /* we can register the device now, as it is ready */
        retval = usb_register_dev(interface, &yurex_class);