[BUG] can: double free in unlink_all_urbs() in ems_usb and usb_8dev

[Farhad Alemi]

Hello Marc and Vincent,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/100-can-usb-double-free-unlink_all_urbs-ems_usb-usb_8dev/

  BUG: KASAN: double-free in unlink_all_urbs+0xc2/0x740
       drivers/net/can/usb/ems_usb.c:713
  ems_usb_disconnect+0x83/0x130 drivers/net/can/usb/ems_usb.c:1088

  BUG: KASAN: double-free in unlink_all_urbs+0xbe/0x660
       drivers/net/can/usb/usb_8dev.c:840
  usb_8dev_disconnect+0xaf/0xd0 drivers/net/can/usb/usb_8dev.c:1004

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,