This is a note to let you know that I've just added the patch titled USB: cdc-acm: fix use-after-free after probe failure to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-cdc-acm-fix-use-after-free-after-probe-failure.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 4e49bf376c0451ad2eae2592e093659cde12be9a Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@xxxxxxxxxx> Date: Mon, 22 Mar 2021 16:53:12 +0100 Subject: USB: cdc-acm: fix use-after-free after probe failure From: Johan Hovold <johan@xxxxxxxxxx> commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream. If tty-device registration fails the driver would fail to release the data interface. When the device is later disconnected, the disconnect callback would still be called for the data interface and would go about releasing already freed resources. Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()") Cc: stable@xxxxxxxxxxxxxxx # 3.9 Cc: Alexey Khoroshilov <khoroshilov@xxxxxxxxx> Acked-by: Oliver Neukum <oneukum@xxxxxxxx> Signed-off-by: Johan Hovold <johan@xxxxxxxxxx> Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@xxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/usb/class/cdc-acm.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1516,6 +1516,11 @@ skip_countries: return 0; alloc_fail6: + if (!acm->combined_interfaces) { + /* Clear driver data so that disconnect() returns early. */ + usb_set_intfdata(data_interface, NULL); + usb_driver_release_interface(&acm_driver, data_interface); + } if (acm->country_codes) { device_remove_file(&acm->control->dev, &dev_attr_wCountryCodes); Patches currently in stable-queue which might be from johan@xxxxxxxxxx are queue-5.11/usb-cdc-acm-fix-use-after-free-after-probe-failure.patch queue-5.11/usb-cdc-acm-fix-double-free-on-probe-failure.patch