[PATCH] most: usb: don't use a NULL device on disconnect

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

hdm_disconnect() clears mdev->usb_device before it stops the link status
timer and the work which that timer schedules.  wq_netinfo() does not
expect a NULL pointer: it hands it to drci_rd_reg(), which dereferences
it.  Stop the timer and the work first.

The interface stays registered until the end of hdm_disconnect(), so
hdm_request_netinfo() can still be called and arm the timer.  Shut the
timer down, rather than delete it, so that this has no effect.

wq_clear_halt() has the same problem.  It is only cancelled when the
channels are poisoned, by most_deregister_interface(), and cannot be
cancelled earlier since the URB handlers schedule it.  It takes io_mutex,
like the code which clears the pointer, so test the pointer there.

Fixes: a4198cdf0c34 ("Staging: most: add MOST driver's hdm-usb module")
Cc: stable <stable@xxxxxxxxxx>
Cc: Parthiban Veerasooran <parthiban.veerasooran@xxxxxxxxxxxxx>
Cc: Christian Gromm <christian.gromm@xxxxxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/most/most_usb.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c
index 6437733afee0..9485f5a51f5f 100644
--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -735,6 +735,10 @@ static void wq_clear_halt(struct work_struct *wq_obj)
 	int peer;
 
 	mutex_lock(&mdev->io_mutex);
+	if (!mdev->usb_device) {
+		mutex_unlock(&mdev->io_mutex);
+		return;
+	}
 	most_stop_enqueue(&mdev->iface, channel);
 	usb_kill_anchored_urbs(&mdev->busy_urbs[channel]);
 	if (usb_clear_halt(mdev->usb_device, pipe))
@@ -1108,14 +1112,15 @@ static void hdm_disconnect(struct usb_interface *interface)
 {
 	struct most_dev *mdev = usb_get_intfdata(interface);
 
+	/* hdm_request_netinfo() can still be called, and arms the timer */
+	timer_shutdown_sync(&mdev->link_stat_timer);
+	cancel_work_sync(&mdev->poll_work_obj);
+
 	mutex_lock(&mdev->io_mutex);
 	usb_set_intfdata(interface, NULL);
 	mdev->usb_device = NULL;
 	mutex_unlock(&mdev->io_mutex);
 
-	timer_delete_sync(&mdev->link_stat_timer);
-	cancel_work_sync(&mdev->poll_work_obj);
-
 	if (mdev->dci)
 		device_unregister(&mdev->dci->dev);
 	most_deregister_interface(&mdev->iface);
-- 
2.56.0