Re: [BUG] drivers/usb: NULL pointer dereference in stub_recv_cmd_submit()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Mon, Sep 14, 2026 at 03:11:08PM -0700, Xiang Mei wrote:
> On Sun, Sep 13, 2026 at 2:19 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Sat, Sep 12, 2026 at 11:41:00AM -0700, Xiang Mei wrote:
> > > On Fri, Sep 11, 2026 at 10:47 PM Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Sat, Sep 12, 2026 at 02:06:13AM +0000, co wrote:
> > > > > This is a bug report, not a patch submission. See
> > > > > https://bugs.sh/reporting.html
> > > > >
> > > > > We found a bug reachable in:
> > > > >
> > > > >     path    drivers/usb/usbip
> > > > >     crash   NULL pointer dereference in stub_recv_cmd_submit()
> > > > >     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> > > > >
> > > > > Config, environment, the sanitizer report and a C reproducer follow.
> > > > >
> > > > > == Notes ===============================================================
> > > > >     If you fix this bug, this tag credits the report and lets us
> > > > >     close it on our side:
> > > > >
> > > > > Reported-by: co+66c3f58096d0bde8@bugs.sh
> > > > >
> > > > >     Everything in this mail is validated by the reproducer below.
> > > > >
> > > > >     We also hold an unreviewed LLM-generated analysis and candidate
> > > > >     patch. The same reproducer panics the unpatched kernel and runs
> > > > >     clean with that patch applied. Use it as a starting point, or ignore
> > > > >     it and write your own:
> > > > >
> > > > >         patch.diff  https://bugs.sh/b/66c3f58096d0bde8/patch.diff
> > > >
> > > > Please just submit patches like normal, in a format that can be applied,
> > > > and do not make us go to random links to attempt to get any information.
> > > > That's not how kernel development works at all.
> > > >
> > >
> > > Hi Greg,
> > >
> > > Sorry about this. We may have misunderstood your earlier reply in this thread:
> > >
> > > "But sure, posting bug reports is fine, but again, patches are better :)"
> > >
> > > https://lore.kernel.org/all/2026090139-shortlist-junkie-9bee@gregkh/#t
> > >
> > > We interpreted this as meaning that sending bug reports without
> > > patches was acceptable. We understand your concern with the current
> > > format, and we will stop sending reports in this format to you and
> > > linux-usb@vger.kernel.org.
> > >
> > > To make sure we understand correctly and follow the appropriate
> > > practice going forward, should we:
> > >
> > > 1. Send pure bug reports without any LLM-generated analysis or
> > > candidate patch, similar to the bug reports syzbot sends to kernel
> > > mailing lists;
> > > 2. For USB, do not send bug reports and only submit patches in the
> > > normal kernel format; or
> > > 3. More generally, do not send bug reports to Linux kernel mailing
> > > lists and only submit patches in the normal kernel format?
> > >
> > > Sorry again for the misunderstanding, and thanks for taking the time
> > > to clarify this despite your busy schedule.
> >
> > Think about what _you_ would want to see if you were on the receiving
> > end of hundreds of patches a week.  Would you want to see a vague email
> > with links required to dig stuff out to potentially have to make up a
> > fix yourself for an unknown and poorly worded description, or would you
> > want a real patch, in mergable format, that describes the problem and
> > how it is being resolved?
> >
> > I think the latter :)
> >
> 
> 
> 
> > Right now, most developers just ignore syzbot reports, as we are
> > drowning in real fixes from developers instead.  There's no need for us
> > to go research new fixes when we are having a hard time keeping on top
> > of the stuff people are sending us that are in mergable state already!
> >
> 
> You are right. We understand how overloaded maintainers and reviewers
> are right now.
> 
> It's true that bug reports without a mergeable patch still take
> maintainers' attention, even when no response is expected.
> 
> We'd still like to make one last request: would it be okay to continue
> sending a small number of reports to other lists, with no external
> links (just PoC and crash sanitizer log)? We'd take responsibility for
> each report and follow up with a patch, even if no one responds. We
> just hope that contributors who know the subsystem better might be
> interested in helping us check the issues.

Why not just send patches to resolve the issues?  That's the best thing
to work from, especially as you have ways to test if your patch is
correct or not.

thanks,

greg k-h