From: Alan Stern <stern@rowland.harvard.edu>
To: Jie Deng <dengjie03@kylinos.cn>
Cc: gregkh@linuxfoundation.org, mathias.nyman@linux.intel.com,
sakari.ailus@linux.intel.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: core: fix NULL dereference in usb_ifnum_to_if() during device removal
Date: Thu, 13 Nov 2025 09:50:42 -0500 [thread overview]
Message-ID: <0bec2aa5-cb3e-49c2-ab40-39a9ebceb2ad@rowland.harvard.edu> (raw)
In-Reply-To: <20251113114411.1410343-1-dengjie03@kylinos.cn>
On Thu, Nov 13, 2025 at 07:44:11PM +0800, Jie Deng wrote:
> During USB device hot-unplug, in the time window between when
> usb_disconnect() calls usb_disable_device() to set
> dev->actconfig->interface[i] to NULL but before dev->actconfig
> is set to NULL.At this point, outside the kernel, usb_ifnum_to_if()
> is called through usb_set_interface(), and usb_ifnum_to_if() continues
> to access interface[i]->altsetting[i], triggering a null pointer.
> [ 9518.891254][ 1] [ T4650] Call trace:
> [ 9518.894817][ 1] [ T4650] usb_ifnum_to_if+0x34/0x50
> [ 9518.899681][ 1] [ T4650] usb_set_interface+0x108/0x3c8
> [ 9518.904898][ 1] [ T4650] uvc_video_stop_streaming+0x3c/0x90 [uvcvideo]
> [ 9518.911500][ 1] [ T4650] uvc_stop_streaming+0x24/0x90 [uvcvideo]
> [ 9518.917583][ 1] [ T4650] __vb2_queue_cancel+0x44/0x458 [videobuf2_common]
> [ 9518.924444][ 1] [ T4650] vb2_core_streamoff+0x20/0xb8 [videobuf2_common]
> [ 9518.931221][ 1] [ T4650] vb2_streamoff+0x18/0x60 [videobuf2_v4l2]
> [ 9518.937390][ 1] [ T4650] uvc_queue_streamoff+0x30/0x50 [uvcvideo]
> [ 9518.943557][ 1] [ T4650] uvc_ioctl_streamoff+0x40/0x68 [uvcvideo]
> [ 9518.949724][ 1] [ T4650] v4l_streamoff+0x20/0x28
> [ 9518.954415][ 1] [ T4650] __video_do_ioctl+0x17c/0x3e0
> [ 9518.959540][ 1] [ T4650] video_usercopy+0x1d8/0x558
> [ 9518.964490][ 1] [ T4650] video_ioctl2+0x14/0x1c
> [ 9518.969094][ 1] [ T4650] v4l2_ioctl+0x3c/0x58
> [ 9518.973526][ 1] [ T4650] do_vfs_ioctl+0x374/0x7b0
> [ 9518.978304][ 1] [ T4650] ksys_ioctl+0x78/0xa8
> [ 9518.982734][ 1] [ T4650] sys_ioctl+0xc/0x18
> [ 9518.986991][ 1] [ T4650] __sys_trace_return+0x0/0x4
> [ 9518.991943][ 1] [ T4650] Code: eb04005f 54000100 f9400040 91002042 (f9400003)
> [ 9518.999153][ 1] [ T4650] ---[ end trace f7c7d3236806d9a4 ]---
This looks like a bug in the uvc driver. usb_disable_device() unbinds
ther interface's driver before it sets dev->actconfig->interface[i] to
NULL, and the uvc driver shouldn't call usb_set_interface() after it has
been unbound.
> To resolve this issue, a null pointer check for config->interface[i]
> can be added in the usb_ifnum_to_if() function.
That won't fix the real bug. You need to change the uvc driver.
Alan Stern
next prev parent reply other threads:[~2025-11-13 14:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-13 11:44 Jie Deng
2025-11-13 13:28 ` Greg KH
2025-11-17 8:50 ` Jie Deng
2025-11-13 14:50 ` Alan Stern [this message]
2025-11-17 5:33 ` Jie Deng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0bec2aa5-cb3e-49c2-ab40-39a9ebceb2ad@rowland.harvard.edu \
--to=stern@rowland.harvard.edu \
--cc=dengjie03@kylinos.cn \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mathias.nyman@linux.intel.com \
--cc=sakari.ailus@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®