[PATCH] usb: gadget: printer: clear current RX request on unbind

[Elliot Alderson]

printer_func_unbind() frees current_rx_req but leaves the pointer in
printer_dev. A later unbind can then pass the stale pointer to
printer_req_free() again. Clear the saved request and its associated read
state before freeing it.

Fixes: b185f01a9ab7 ("usb: gadget: printer: factor out f_printer")
Reported-by: syzbot+ffc483dc87891d3c107b@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?extid=ffc483dc87891d3c107b
Signed-off-by: Eduard Zateev <hackerowskiy@xxxxxxxxx>
---
 drivers/usb/gadget/function/f_printer.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_printer.c
b/drivers/usb/gadget/function/f_printer.c
index 1857d786110..11471bd065c 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -1462,8 +1462,11 @@ static void printer_func_unbind(struct
usb_configuration *c,
         printer_req_free(dev->in_ep, req);
     }

-    if (dev->current_rx_req != NULL)
-        printer_req_free(dev->out_ep, dev->current_rx_req);
+    req = dev->current_rx_req;
+    dev->current_rx_req = NULL;
+    dev->current_rx_bytes = 0;
+    dev->current_rx_buf = NULL;
+    printer_req_free(dev->out_ep, req);

     while (!list_empty(&dev->rx_reqs)) {
         req = container_of(dev->rx_reqs.next,
-- 
2.55.0