From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16BFE19AD90 for ; Thu, 6 Aug 2026 17:25:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786037132; cv=none; b=mek6tGKegfY+Nhv9gcTQhLcs6F62ftPkVEBvkmXdwDfSqamDiib8nYoMyy2dczqq489s5Sp3+Cj898TEY/qI0GMDi3Jui58cKNHfhKnxERkRSfEoIeDrXhYlUparqSUoo8ZucLamcsnFIdBKoUS/Olp4lAr+nA5If8OgGXr7eW8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786037132; c=relaxed/simple; bh=6iehjLz7tK5y+wF7aaPT++cscWa2tz3sEd1stPo+JWc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e4GeQudx8HuG9tRKu/C75vE7co97ilNrAfk8Q77mg8BV+b3SZu6w41MAsXnOVh+ZQdLNBO0jRtaN930dgU+p5cL9CH6e9q3pakkr9+YOPs/W0FXLqhyocPSjTr1lD4ovW6JudKN9c86wocu65a1XVSqTK3XDCgpjUSG+hCyhZWc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pw9ptqlC; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pw9ptqlC" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-382ef647e20so2695720a91.1 for ; Thu, 06 Aug 2026 10:25:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786037130; x=1786641930; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+TRdZm2/OzOJOHLAefUfdbI0717vY0s82LnHh3Ur5RU=; b=Pw9ptqlCc5rOjAO4BXNmTTEMDJnKqw7XP81Rrvodq+jkgjRuPUm5BU4pv69plaar2A 3QTEsx7bMDqqaaxemFmoPKCrjyCydKb33ve6bjh8Xo1HKhf5vvy+9cfuyXBm07DPWtzi lARALAsc49dNY6gcc0whhbFrPcYCE7pAVb5pWedQ6NyjAygrGscK6ZdMSTZ2xd2MUSDV ouzdCSqkuSzdDSnTPtQO8HTT/xpEUKXTWvWkVZEZGfyJLZ1grYzUCbIh2zKqzRgdwud2 o4gAA1cY3paoPQY7bQ/C3C4uPyjtbXXOU6g/k/ihlQDJryq0whq9ZP822IPPZa43qI5R BM/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786037130; x=1786641930; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+TRdZm2/OzOJOHLAefUfdbI0717vY0s82LnHh3Ur5RU=; b=q3BT6e81Z5ViUEFRF4GagJTk1ROvTHWD4qV/M2onqs7jr8k4TVn6G4tSLDQcOsqbdq Qre4uaNG3t2JJyz4KEqNzbB3rwkLt5aBuyNDt+HmW0EwkLaiu8JokaJIOaMGH6jU0OMT NZz71hbIx5dmLXvQXVLtWdbCrTN3kFB/Qty92ai77GW4oL+eZWzZ2zKdk1rOuUWrYpBo kfQDwd6TucD94bocAxFiL5bGFZ2OrFz/+dfLwqoesPolNkWNwGyRvm3eskPPBhUCWvM+ 5iR/7nhLjg4BQzlYb20M2IL9+CpyOR1jVTLAuYe/aEIKhVFbAtTEYpJTQYbSO/J/eH07 Q4DQ== X-Forwarded-Encrypted: i=1; AHgh+RqPExgpoEDAMqtJSC2xUz8GLsrZRRBAjIsqzyBkRfFrskGVJS0EG7876DzI0c1vvN8/7MgfxxukMFYr9z8=@vger.kernel.org X-Gm-Message-State: AOJu0Yy8mrp5sy5dDNf4GioVfLRTJBXQkXR7DrBBl9tIAUYE9x2qo0Q4 5fTzsDb5FD0gI8/7hoon97lIYDUeqU4kZx739+3JgxCRDwoNMC55mYO9 X-Gm-Gg: AR+sD11Qx80VAaBADflZ/k7vmyzsLOFsmT9L0YlMbb0lQpaNv2cbf5OhrIL1+8VP9sl 1d/mVg0CIDOzUevt80pin8sMM4Fx+yLnsxkGghoPpnCCuKoYlGT/nJpRnBq6sjNlHDe+PD31S+S GWwthegP+MDySQr8qdqCot4CeC80uA3XYY6FT9naqBPHCjX8197ewOS+fKJ8lPi7kB2gOA7K5On e47TqkX5/gh/+YffXa0fCcITQjYa2QU27pGTDwLXx7fX0A9DrG2NpQ/p8P8neAf+YPU7EGxszwu aOpvnSpMsKUxWJtSDF5yS9tFQs1DIrqDyt2/IguKq/IKza/CqAd1HQEG8p261sl9xjCtsm/tXQB 9/Bm8XUfP5JMPOOfX/PM8Cd2bt/ZeNGYroxc7isQR1DeLthpyfQseIWEhi8XaN3dr6hERCnqKh1 LUBAxE9cL6Ef4sQpAAPO5Iklypnxh2/k8ujhcFA+lvJqkV2o1A+Y2Sd3Ia1f6C4eLg X-Received: by 2002:a17:90b:1c0a:b0:38e:ad9d:1161 with SMTP id 98e67ed59e1d1-3903b9eab48mr15997786a91.0.1786037130324; Thu, 06 Aug 2026 10:25:30 -0700 (PDT) Received: from Default ([2409:40f4:1024:7ab9:e121:51b9:f38d:da64]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315867d7e4csm31113126eec.31.2026.08.06.10.25.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 06 Aug 2026 10:25:29 -0700 (PDT) From: Jeffin Philip To: gregkh@linuxfoundation.org Cc: i@zenithal.me, jeffinphilip14@gmail.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, shuah@kernel.org, stable@vger.kernel.org, syzbot+af76b01c9a0f0ab60fb0@syzkaller.appspotmail.com, valentina.manea.m@gmail.com Subject: Re: [PATCH] usbip: usbip_host: Fix null pointer dereference in rebind_store Date: Thu, 6 Aug 2026 22:55:13 +0530 Message-ID: <20260806172513.126406-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <2026080645-nickname-undated-d0bb@gregkh> References: <2026080645-nickname-undated-d0bb@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Thu, Aug 06, 2026 at 07:42:27 +0200, Greg KH wrote: >On Thu, Aug 06, 2026 at 11:06:51AM +0530, Jeffin Philip wrote: >> On Thu, Aug 06 2026, Greg KH wrote: >> >What prevents bid->udev from becoming NULL right after you checked this? >> We could use usb_get_dev() and hold a reference to udev when the busid_lock >> is being held and then release it after do_rebind, or would that be incorrect? > >I do not know, try it and see! I tested usb_get_dev() and usb_put_dev() on the rebind path and it compiled without errors. No undesired behavior during rebind either. >> >How was this tested? >> The method to reproduce it is in the same thread. > >How is this just now an issue? What changed to cause it to suddenly >start happening, or has this codepath never been tested? Nothing has changed AFAIK. The driver itself depended on sequential order of operations and in doing so, failed to secure itself against non-sequential order of operations. I will send patch v2 soon addressing these issues. Thanks, Jeffin.