Johan Hovold aafb00a977 USB: yurex: fix NULL-derefs on disconnect ... The driver was using its struct usb_interface pointer as an inverted disconnected flag, but was setting it to NULL without making sure all code paths that used it were done with it. Before commit ef61eb43ad ("USB: yurex: Fix protection fault after device removal") this included the interrupt-in completion handler, but there are further accesses in dev_err and dev_dbg statements in yurex_write() and the driver-data destructor (sic!). Fix this by unconditionally stopping also the control URB at disconnect and by using a dedicated disconnected flag. Note that we need to take a reference to the struct usb_interface to avoid a use-after-free in the destructor whenever the device was disconnected while the character device was still open. Fixes: aadd6472d9 ("USB: yurex.c: remove dbg() usage") Fixes: 45714104b9 ("USB: yurex.c: remove err() usage") Cc: stable <stable@vger.kernel.org> # 3.5: ef61eb43ad Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009153848.8664-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-10-10 14:24:06 +02:00
..
sisusbvga
adutux.c	USB: adutux: fix use-after-free on release	2019-10-10 12:43:19 +02:00
appledisplay.c
chaoskey.c	USB: chaoskey: fix use-after-free on release	2019-10-10 12:43:19 +02:00
cypress_cy7c63.c
cytherm.c
ehset.c
emi26.c
emi62.c
ezusb.c
ftdi-elan.c
idmouse.c
iowarrior.c	USB: iowarrior: use pr_err()	2019-10-10 12:45:07 +02:00
isight_firmware.c
Kconfig	USB: rio500: Remove Rio 500 kernel driver	2019-10-04 10:53:36 +02:00
ldusb.c	USB: ldusb: fix NULL-derefs on driver unbind	2019-10-10 12:43:18 +02:00
legousbtower.c	USB: legousbtower: fix use-after-free on release	2019-10-10 12:43:18 +02:00
lvstest.c
Makefile	USB: rio500: Remove Rio 500 kernel driver	2019-10-04 10:53:36 +02:00
trancevibrator.c
usb251xb.c
usb3503.c
usb4604.c
usb_u132.h
usblcd.c	USB: usblcd: use pr_err()	2019-10-04 11:11:08 +02:00
usbsevseg.c
usbtest.c
uss720.c
yurex.c	USB: yurex: fix NULL-derefs on disconnect	2019-10-10 14:24:06 +02:00