usblp: poison URBs upon disconnect

syzkaller reported an URB that should have been killed to be active.
We do not understand it, but this should fix the issue if it is real.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20200507085806.5793-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 0d8e3f3804a3f87e8d8a29442f2db0a50c621ac7..084c48c5848fc90354216254ffbd48c17a7be030 100644 (file)
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -468,7 +468,8 @@ static int usblp_release(struct inode *inode, struct file *file)
        usb_autopm_put_interface(usblp->intf);
 
        if (!usblp->present)            /* finish cleanup from disconnect */
-               usblp_cleanup(usblp);
+               usblp_cleanup(usblp);   /* any URBs must be dead */
+
        mutex_unlock(&usblp_mutex);
        return 0;
 }
@@ -1375,9 +1376,11 @@ static void usblp_disconnect(struct usb_interface *intf)
 
        usblp_unlink_urbs(usblp);
        mutex_unlock(&usblp->mut);
+       usb_poison_anchored_urbs(&usblp->urbs);
 
        if (!usblp->used)
                usblp_cleanup(usblp);
+
        mutex_unlock(&usblp_mutex);
 }