Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect

[Oliver Neukum]

Hi,

On 13.01.26 16:47, weipeng wrote:
  
> @@ -287,9 +321,12 @@ static void i2c_tiny_usb_disconnect(struct usb_interface *interface)
>   {
>   	struct i2c_tiny_usb *dev = usb_get_intfdata(interface);
>   
> -	i2c_del_adapter(&dev->adapter);
> +	mutex_lock(&dev->usb_lock);
>   	usb_set_intfdata(interface, NULL);
> -	i2c_tiny_usb_free(dev);
> +	dev->disconnected = true;
> +	mutex_unlock(&dev->usb_lock);
> +
> +	queue_work(system_long_wq, &dev->release_work);
>   
>   	dev_dbg(&interface->dev, "disconnected\n");
>   }

what prevents the following sequence:

i2c_tiny_usb_disconnect() -> module unload -> i2c_tiny_usb_release()

As far as I can tell, this can happen and you'd execute already
freed memory.

	Regards
		Oliver