Re: [PATCH] USB: iowarrior: fix use-after-free on disconnect

[Johan Hovold]

On Sun, May 24, 2026 at 08:09:00AM +0200, Greg Kroah-Hartman wrote:
> On Sat, May 23, 2026 at 07:05:23PM +0200, Johan Hovold wrote:
> > Submitted write URBs are not stopped on close() and therefore need to be
> > stopped unconditionally on disconnect() to avoid use-after-free in the
> > completion handler.
> > 
> > Fixes: b5f8d46867ca ("USB: iowarrior: fix use-after-free after driver unbind")
> > Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
> > Reported-by: syzbot+ad2aac2febc3bedf0962@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Link: https://lore.kernel.org/all/6a0ce39b.170a0220.39a13.0007.GAE@xxxxxxxxxx/
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
> > ---
> 
> Reviewed-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

Someone else just sent a fix for this so sending a reminder about this
one in case there was some confusion about who was going to pick it up.

Can be queued after rc1 is out too of course.

Johan