From: jiawen <1298662399@qq.com>

In tower_probe(), usb_set_intfdata() is called before
usb_register_dev(). If registration fails, the error path calls
tower_delete() which frees the device, but the interface data still
points to the freed memory. A subsequent disconnect would dereference
stale data.

Clear the interface data before freeing the device on the registration
failure path. Similarly, tower_disconnect() retrieves the interface data
but never clears it before possibly calling tower_delete(). Clear the
interface data before the possible tower_delete() call to avoid leaving
stale interface data after disconnect.

Signed-off-by: jiawen <1298662399@qq.com>
---
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index 111111111111..222222222222 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -814,7 +814,8 @@ static int tower_probe(struct usb_interface *interface, const struct usb_device_id *id)
 	retval = usb_register_dev(interface, &tower_class);
 	if (retval) {
 		/* something prevented us from registering this driver */
 		dev_err(idev, "Not able to get a minor for this device.\n");
+		usb_set_intfdata(interface, NULL);
 		goto error;
 	}
 	dev->minor = interface->minor;
@@ -846,6 +847,8 @@ static void tower_disconnect(struct usb_interface *interface)
 	dev = usb_get_intfdata(interface);
 
 	minor = dev->minor;
+
+	usb_set_intfdata(interface, NULL);
 
 	/* give back our minor and prevent further open() */
 	usb_deregister_dev(interface, &tower_class);

On Tue, Aug 18, 2026 at 04:41:28PM +0400, Jiawen Liu wrote:
> From: jiawen <1298662399@qq.com>

Your full name is needed here and below.

> In tower_probe(), usb_set_intfdata() is called before
> usb_register_dev(). If registration fails, the error path calls
> tower_delete() which frees the device, but the interface data still
> points to the freed memory. A subsequent disconnect would dereference
> stale data.

This makes no sense as disconnect() is not called if probe() fails.

> Clear the interface data before freeing the device on the registration
> failure path. Similarly, tower_disconnect() retrieves the interface data
> but never clears it before possibly calling tower_delete(). Clear the
> interface data before the possible tower_delete() call to avoid leaving
> stale interface data after disconnect.

That's not needed either as disconnect() will not free the driver data
until after deregistering the class device (which takes care of any
racing call to open() which accesses the driver data).

> Signed-off-by: jiawen <1298662399@qq.com>

Johan