Re: [PATCH] USB: iowarrior: fix use-after-free on disconnect

[Greg Kroah-Hartman]

On Sat, May 23, 2026 at 07:05:23PM +0200, Johan Hovold wrote:
> Submitted write URBs are not stopped on close() and therefore need to be
> stopped unconditionally on disconnect() to avoid use-after-free in the
> completion handler.
> 
> Fixes: b5f8d46867ca ("USB: iowarrior: fix use-after-free after driver unbind")
> Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
> Reported-by: syzbot+ad2aac2febc3bedf0962@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/all/6a0ce39b.170a0220.39a13.0007.GAE@xxxxxxxxxx/
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
> ---

Reviewed-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>