Input: powermate - fix use-after-free in powermate_config_complete

stable inclusion
from stable-v4.19.297
commit 67cace72606baf1758fd60feb358f4c6be92e1cc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94PA7
CVE: CVE-2023-52475

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=67cace72606baf1758fd60feb358f4c6be92e1cc

-----------------------------------------------------

commit 5c15c60e upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e



Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by:  <syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com


Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
(cherry picked from commit 5783d7ca)