[PATCH] usb: legousbtower: clear interface data on probe failure and disconnect

[Jiawen Liu]

From: jiawen <1298662399@xxxxxx>

In tower_probe(), usb_set_intfdata() is called before
usb_register_dev(). If registration fails, the error path calls
tower_delete() which frees the device, but the interface data still
points to the freed memory. A subsequent disconnect would dereference
stale data.

Clear the interface data before freeing the device on the registration
failure path. Similarly, tower_disconnect() retrieves the interface data
but never clears it before possibly calling tower_delete(). Clear the
interface data before the possible tower_delete() call to avoid leaving
stale interface data after disconnect.

Signed-off-by: jiawen <1298662399@xxxxxx>
---
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index 111111111111..222222222222 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -814,7 +814,8 @@ static int tower_probe(struct usb_interface *interface, const struct usb_device_id *id)
 	retval = usb_register_dev(interface, &tower_class);
 	if (retval) {
 		/* something prevented us from registering this driver */
 		dev_err(idev, "Not able to get a minor for this device.\n");
+		usb_set_intfdata(interface, NULL);
 		goto error;
 	}
 	dev->minor = interface->minor;
@@ -846,6 +847,8 @@ static void tower_disconnect(struct usb_interface *interface)
 	dev = usb_get_intfdata(interface);
 
 	minor = dev->minor;
+
+	usb_set_intfdata(interface, NULL);
 
 	/* give back our minor and prevent further open() */
 	usb_deregister_dev(interface, &tower_class);