From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BCE93B7B72 for ; Tue, 11 Aug 2026 16:06:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786464362; cv=none; b=FnjN9SY4Upk7ZWde0hdBFN9US4SFj6cFNCO/4FX+1Bgm51KQjT/U+5FK5JZVUi++sA3ldaSofcofrai124yEwEDCSnG9oXqQGAv9qs6UmOPWMvU9EOubMCGwiWHmjoFnuyZe6lg7HTcVB/czewYp4AKFWs+74V1xUkx7S3t6g9k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786464362; c=relaxed/simple; bh=3v4BhFVPmtY/4EGAVqwrMznFB+Ecyz61DzuAVdipuhU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uivWVPMDO4eSwLrzOL/XXwocg/oLWEvx2et/bOGnn1Pzg6n239NQS0SkBy/dpm93Fn5gYtCwRooNznx80z1rCVVlJjVgYwVvc4kyHj9I4kEu5rvh6OBN3TgNfuwM87bUkIbQgbS+XrAddg8OpNKzAaVOjHe7JdFmERTCLbF35y8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WA2W2gFk; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WA2W2gFk" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-cbe827e3cb4so3572972a12.3 for ; Tue, 11 Aug 2026 09:06:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786464361; x=1787069161; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=IVGV0R5tdq0CzGSbWbNPeQqwE8jl6T9+ZKf8qCD85WY=; b=WA2W2gFkrQsu2rrnyJOCgVhxLj9vMqZtjYxYOHfLNT/ibHiiK62eLpfGh8OJLLO8Zl 0HC8wSJcwCm8NVTt6jcbnrYCg5yIinaUCbtqAZNzgx8tVjC+2Nz0BKkAZwvzyoVbv0bT +K8xPww22mahwykJ22ZEE6uUj9B4Siy5+n3O/nb8knsXLLiEqGFVLxot2+ASa5v9Kas/ +AlU3VxpJztP7zkRBONR6kyO6sYBIALONo1jL1p/VuBjOqtstPbV39rbJ/03G4ijeRXM 2ZLkLbCuX3lYTr/XWhX7aFVKeq3q99jCQwqVxBKkGHHAr+gao6t/wG5BwRNhuaiq1H8A KYPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786464361; x=1787069161; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IVGV0R5tdq0CzGSbWbNPeQqwE8jl6T9+ZKf8qCD85WY=; b=b/EgOwoaYBtNBUXUQiVtGg/mBI7XONZQafQz25NI0w7abT+LtN0RvcIUBkKLQ/YcHS gLVfIvGdr4VC16SfhBs9bpaDtCy6Uxj/sqMFlpqJmv8GKJ1QJc86HNKZiY55nYh5FMeU d9ksgkccu0cJuJP9aM0DIiGFj2M74hIxN6IaC9SS+0o18BtmwjzxIzos1OLZVslgzTgJ /sv+fit+83PGwHE8YT48VEMOv6pvGqk4I3wemnMNg1pddknsUO+2UxCPu7MudI1sSoK8 +VwRAY+xkafDLRIMhbiOMumakBJX5xIJwdg7vh1nYu2EPFbijvVpIJOpW4EHWzhs0tpa m3CA== X-Forwarded-Encrypted: i=1; AHgh+RrwduZb6r22h8n0thFb4n3ex2quBDC7c7Z9Vv2JasGiEOQZg3/UQGlNXQNiNoort5iLZMYA69I5LLjWkcw=@vger.kernel.org X-Gm-Message-State: AOJu0YxYhC52UZ16u8YhrTQkpY9tIjOSF6iWUl1yyfLgx69cAc7CmE+E HWaPAGX5+diSCPIt1993oQuHvlVk8YiTvgOhYDY3ZTO0M55VeeNlIitG X-Gm-Gg: AR+sD11rFF/uVUW6Y43NY5yqCUrnfvGr6ihrooG+GX9pUkzo5v9e7fMVASqt6tO4+tJ zcK2Ue8+NHZ/248Nze1UcMv80rmWRLQShYTlfmHW9R7I3uYjt87qB8yf9/OCjxsHRKkJjODD0id VC7Ix/qE/WsjDfNmekn5WeUc+ZLk8FkMzeMzigWrfQAVnL2UnFJQjKkhFgGXHbWxZ4RKpOwDNeX /z06pPCCCgZcDEEX/sYY1C9xFT0sWOpfK8x43H4CLPzCEWRoslEpfqmjsYoK05iePo9fdPl6mJ4 y5QlIdP/b4eA/TxhjVL+EMxQldaOY3DkhvykZG3HzG3rWvcXA2AhyizJZoroEhV76h8EafiJ+pc IpdyH/WAmNd3XXtM8mDClhOpM2AGASCWfPph96cUCsTWbY+QK/OKuf7jtU9bhSngw6clB2jUSVL O07S1O59IFURtJpSSNr6mBgy6nW29j4fOhyy0Abq7KkN6jTS393megt+af6vtlvF5cGw== X-Received: by 2002:a05:6a21:2d8b:b0:3c3:a1e6:a626 with SMTP id adf61e73a8af0-3cc2bacd73emr6410918637.32.1786464360559; Tue, 11 Aug 2026 09:06:00 -0700 (PDT) Received: from Default ([2409:40f4:1011:30f7:310c:32cf:5ea7:7043]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31cf3624c08sm916149eec.5.2026.08.11.09.05.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 09:05:59 -0700 (PDT) From: Jeffin Philip To: valentina.manea.m@gmail.com, shuah@kernel.org, gregkh@linuxfoundation.org Cc: i@zenithal.me, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+af76b01c9a0f0ab60fb0@syzkaller.appspotmail.com, Jeffin Philip Subject: [PATCH v3 0/2] usbip: usbip_host: remove legacy rebind_store in favor of drivers_probe Date: Tue, 11 Aug 2026 21:35:39 +0530 Message-ID: <20260811160541.29461-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit do_rebind, which sleeps normally gets a mutex lock. However, it does not or should I say, cannot check for null udev between spin lock dropped in rebind_store and entering do_rebind. This is a potential race window already. So, even if we check for null udev under spinlock, we cannot do it outside. Regarding do_rebind, it is called during stub_device_rebind, but that function is called during module exit when all files are removed. So, do_rebind is not designed to work in a concurrent environment in the first place. We have a safer function that can already do what do_rebind does, drivers_probe. So, we use drivers_probe to rebind the device rather than use rebind_store. usbip tool references this function immediately after the device is unbound, which is safe for the tool itself but since we opted for drivers_probe, fix it by using drivers_probe rather than rebind_store after unbinding device which is more safer. Tested and working in both userspace via the tool and manually echoing the busid in the related nodes. rebind node is still left active with a warning to use drivers_probe upon encountering rebind_store. Thanks, Jeffin. Signed-off-by: Jeffin Philip --- Changes in v3: - Removed rebind_store in favor of drivers_probe to eliminate race condition Changes in v2: - Addressed concerns raised by the Greg KH in v1 discussion - Added usb_get_dev() to get a reference to udev preventing it from becoming null after the null check. Drop the reference after using it in do_rebind(). Did not fix the race. v1: - Initial patch with a udev null check that returns -ENODEV if udev is null. --- Jeffin Philip (2): usbip: usbip_host: fix null pointer dereference in rebind_store usbip: tools: replace faulty rebind_store with drivers_probe drivers/usb/usbip/stub_main.c | 27 +-------------------------- tools/usb/usbip/src/usbip_unbind.c | 7 +++---- 2 files changed, 4 insertions(+), 30 deletions(-) -- 2.55.0