[PATCH 1/1] media: rc: igorplugusb: quiesce callbacks before unregister

[Yuanzhe Liu]

igorplugusb_disconnect() unregisters the rc device before poisoning its
URB. rc_unregister_device() stops the raw-IR kthread, but a completion
callback that is already running can still call ir_raw_event_handle().
This makes wake_up_process() dereference the kthread's freed task_struct
and triggers a KASAN use-after-free in try_to_wake_up().

Poison the URB and delete the timer before unregistering the rc device.
Poisoning drains any active callback and prevents resubmission, while
deleting the timer stops the other URB producer. No callback can then
reach rc-core after its raw-IR kthread has been stopped.

Fixes: b1c97193c643 ("[media] rc: port IgorPlug-USB to rc-core")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuanzhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
---
 drivers/media/rc/igorplugusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index b5117ee..42e05b9 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -241,9 +241,9 @@ static void igorplugusb_disconnect(struct usb_interface *intf)
 {
 	struct igorplugusb *ir = usb_get_intfdata(intf);
 
-	rc_unregister_device(ir->rc);
 	usb_poison_urb(ir->urb);
 	timer_delete_sync(&ir->timer);
+	rc_unregister_device(ir->rc);
 	usb_set_intfdata(intf, NULL);
 	usb_unpoison_urb(ir->urb);
 	usb_free_urb(ir->urb);
-- 
2.45.1.windows.1