Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in keyspan_close

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@xxxxxxxx>

#syz test: upstream 08dbfad3f504

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 17edc057a311..0464dbab17c1 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -301,10 +301,19 @@ static void serial_port_shutdown(struct tty_port *tport)
 	struct usb_serial_port *port =
 		container_of(tport, struct usb_serial_port, port);
 	struct usb_serial_driver *drv = port->serial->type;
+	struct usb_serial *serial = port->serial;
+
+	mutex_lock(&serial->disc_mutex);
+	if (serial->disconnected) {
+		mutex_unlock(&serial->disc_mutex);
+		goto out;
+	}
 
 	if (drv->close)
 		drv->close(port);
 
+	mutex_unlock(&serial->disc_mutex);
+out:
 	usb_autopm_put_interface(port->serial->interface);
 }