Re: [PATCH v4 1/2] hwmon: (powerz) Fix use-after-free on USB disconnect

[Guenter Roeck]

On Fri, Apr 10, 2026 at 12:25:35AM +0000, Pradhan, Sanman wrote:
> From: Sanman Pradhan <psanman@xxxxxxxxxxx>
> 
> After powerz_disconnect() frees the URB and releases the mutex, a
> subsequent powerz_read() call can acquire the mutex and call
> powerz_read_data(), which dereferences the freed URB pointer.
> 
> Fix by:
>  - Setting priv->urb to NULL in powerz_disconnect() so that
>    powerz_read_data() can detect the disconnected state.
>  - Adding a !priv->urb check at the start of powerz_read_data()
>    to return -ENODEV on a disconnected device.
>  - Moving usb_set_intfdata() before hwmon registration so the
>    disconnect handler can always find the priv pointer.
> 
> Fixes: 4381a36abdf1c ("hwmon: add POWER-Z driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sanman Pradhan <psanman@xxxxxxxxxxx>

Applied.

Thanks,
Guenter