---

yaml
---
r: 303901
b: refs/heads/master
c: 6b0b79d
h: refs/heads/master
i:
  303899: fa43bb7
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 616b6937e348ef2b4c6ea5fef2cd3c441145efb0
+refs/heads/master: 6b0b79d38806481c1c8fffa7c5842f3c83679a42

trunk/drivers/usb/class/cdc-wdm.c

@@ -533,7 +533,9 @@ static int wdm_flush(struct file *file, fl_owner_t id)
 	struct wdm_device *desc = file->private_data;
 
 	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
-	if (desc->werr < 0)
+
+	/* cannot dereference desc->intf if WDM_DISCONNECTING */
+	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
 			desc->werr);
 
@@ -625,12 +627,13 @@ static int wdm_release(struct inode *inode, struct file *file)
 	mutex_unlock(&desc->wlock);
 
 	if (!desc->count) {
-		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
-		kill_urbs(desc);
 		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
+			dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+			kill_urbs(desc);
 			desc->manage_power(desc->intf, 0);
 		} else {
-			dev_dbg(&desc->intf->dev, "%s: device gone - cleaning up\n", __func__);
+			/* must avoid dev_printk here as desc->intf is invalid */
+			pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
 			cleanup(desc);
 		}
 	}