From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f70.google.com (mail-ot1-f70.google.com [209.85.210.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59E3D4B048B for ; Sun, 16 Aug 2026 01:16:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786842991; cv=none; b=Sc5Q2syhB8cHvraln4kHxfPDMsEuzkLMViAahNesTsv/CNsLtva3VbHdRsamjSMkuJnrWwb0vIGN5A03q8nuUFlMu4J9k0HbiqPue24qDM4h1MzzsAXg8bY/71kduRyzPQfbaHy8UO7Jlu/wglkkqtf6LnycOuXHz50G7XmcLAY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786842991; c=relaxed/simple; bh=Utb3+JguO7YlH4O93/TCdDxFDMC9ZM7oBFBHuN4CGQQ=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=EfVYjR03Jq2DoKHr9QqJIiT5HDskd023/bOO9hDp9oM2r7ZG2yj2Mu8jgLNNPf1s2p93y+YwMk040E5EIsxOmvhxzOv5pbM8lk9sGFWaUFx2WG4YKPyLCMZhyBIJ1FUq0U4UeKY31NYhPE5OtsWRHFdyUuFWjBQ0FaIhnJMYVL0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7ee4eec47bbso3235209a34.3 for ; Sat, 15 Aug 2026 18:16:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786842988; x=1787447788; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RYME1HiDngskseQEeb5dpx8YKAjPv3iqHfpMq+TlWcY=; b=iiOi8Tu61By+Y9UvCweQ35NwocJEYZ5TEJTIQBdG3WBFuNUTY2JvKiZbnTToC+gZcy 6BSF8ht/85pHPnX1LC0MExjyFrcGc/ZpohEhp87kQR7QSYB9tY/OIA9QKyAGOOQyaYsm QLoohLg/ahFvASm8Tdd02RhxcdCKYX9qJ1R7YOSG5tKnycH5q1pdFz5slUvyl9EAbrRW OH5hruGgvEnX3ny4K0pkOKPaukUps+bFLwr+OI8Y7iXN9gC0TUc5uMl+jmk+hY9l74rH DT3GhMfWqjTVKSAeGFzmIxN9oLjjSusISeIGyL9P7hO2TKtAAOZTVwGWLKWjPmIAjySS yf+Q== X-Gm-Message-State: AOJu0YzWQJ+6k2xKQq4w6LYsodDMsK2V/vnBKLOKzzUBHkYAtZeRWVVe Kkb8ccSvKmIrfrjahvyBqvBYjecYQDV5hr6XBRaG4MYVCFVODe7sRkDXaFkmnBHcG6dLfcx7IXO 7GHZRBNBrg9Asj3AV2fDFaYQj2w2yosK/7szkLzF25DzBd5z02KYmmGvwhJE= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:88f:b0:6ac:b178:97f9 with SMTP id 006d021491bc7-6b0d68e60efmr13995981eaf.31.1786842988218; Sat, 15 Aug 2026 18:16:28 -0700 (PDT) Date: Sat, 15 Aug 2026 18:16:28 -0700 In-Reply-To: <6a7ee0b6.91706f20.9568a.0005.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a810f6c.f7a79266.2f965f.0009.GAE@google.com> Subject: Forwarded: [PATCH] usbip: vhci_hcd: let the driver core manage the sysfs attributes From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] usbip: vhci_hcd: let the driver core manage the sysfs attributes Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master The vhci attribute group is created in vhci_start() and removed in vhci_stop(), guarded by usb_hcd_is_primary_hcd(). Both run from usb_add_hcd()/usb_remove_hcd(), which are called once per hcd, so the attach attribute is live while only one of the two hcds exists: it is created during the first usb_add_hcd() before vhci_hcd_ss is set, and it survives the first usb_put_hcd() on removal. A concurrent write to attach can therefore reach a NULL or freed vhci_hcd_ss. Register the group as dev_groups on the platform driver instead, so the driver core creates the files before probe and removes them after remove returns, and drop the sysfs_create_group()/sysfs_remove_group() calls from the driver. The attributes have always been created only on vhci_hcd.0; an is_visible() callback keeps them there. vhci_init_attr_group() is moved into vhci_hcd_init() ahead of platform_driver_register() so the group is populated before the core reads it. The attribute array is still built at runtime because the number of status attributes comes from CONFIG_USBIP_VHCI_NR_HCS and the preprocessor cannot emit a variable number of __ATTR() declarations. If statically declaring all 32 and hiding the unused ones with is_visible() is preferred, I can respin that way. Reported-by: syzbot+8753715f05759f1a10de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8753715f05759f1a10de Signed-off-by: Deepanshu Kartikey --- v2: - use dev_groups instead of moving sysfs_create_group() into probe (Greg) - add is_visible() to keep the attributes on vhci_hcd.0 only - move vhci_init_attr_group() into vhci_hcd_init() --- drivers/usb/usbip/vhci.h | 1 + drivers/usb/usbip/vhci_hcd.c | 37 ++++++++++------------------------ drivers/usb/usbip/vhci_sysfs.c | 19 +++++++++++++++++ 3 files changed, 31 insertions(+), 26 deletions(-) diff --git a/drivers/usb/usbip/vhci.h b/drivers/usb/usbip/vhci.h index 5659dce1526e..844500e3b0ea 100644 --- a/drivers/usb/usbip/vhci.h +++ b/drivers/usb/usbip/vhci.h @@ -121,6 +121,7 @@ struct vhci_hcd { extern int vhci_num_controllers; extern struct vhci *vhcis; extern struct attribute_group vhci_attr_group; +extern const struct attribute_group *vhci_groups[]; /* vhci_hcd.c */ void rh_port_connect(struct vhci_device *vdev, enum usb_device_speed speed); diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c index 39e8faf4c18c..4bace5b8b879 100644 --- a/drivers/usb/usbip/vhci_hcd.c +++ b/drivers/usb/usbip/vhci_hcd.c @@ -1199,7 +1199,6 @@ static int vhci_start(struct usb_hcd *hcd) { struct vhci_hcd *vhci_hcd = hcd_to_vhci_hcd(hcd); int id, rhport; - int err; usbip_dbg_vhci_hc("enter vhci_start\n"); @@ -1230,40 +1229,17 @@ static int vhci_start(struct usb_hcd *hcd) return -EINVAL; } - /* vhci_hcd is now ready to be controlled through sysfs */ - if (id == 0 && usb_hcd_is_primary_hcd(hcd)) { - err = vhci_init_attr_group(); - if (err) { - dev_err(hcd_dev(hcd), "init attr group failed, err = %d\n", err); - return err; - } - err = sysfs_create_group(&hcd_dev(hcd)->kobj, &vhci_attr_group); - if (err) { - dev_err(hcd_dev(hcd), "create sysfs files failed, err = %d\n", err); - vhci_finish_attr_group(); - return err; - } - dev_info(hcd_dev(hcd), "created sysfs %s\n", hcd_name(hcd)); - } - return 0; } static void vhci_stop(struct usb_hcd *hcd) { struct vhci_hcd *vhci_hcd = hcd_to_vhci_hcd(hcd); - int id, rhport; + int rhport; usbip_dbg_vhci_hc("stop VHCI controller\n"); - /* 1. remove the userland interface of vhci_hcd */ - id = hcd_name_to_id(hcd_name(hcd)); - if (id == 0 && usb_hcd_is_primary_hcd(hcd)) { - sysfs_remove_group(&hcd_dev(hcd)->kobj, &vhci_attr_group); - vhci_finish_attr_group(); - } - - /* 2. shutdown all the ports of vhci_hcd */ + /* shutdown all the ports of vhci_hcd */ for (rhport = 0; rhport < VHCI_HC_PORTS; rhport++) { struct vhci_device *vdev = &vhci_hcd->vdev[rhport]; @@ -1513,6 +1489,7 @@ static struct platform_driver vhci_driver = { .resume = vhci_hcd_resume, .driver = { .name = driver_name, + .dev_groups = vhci_groups, }, }; @@ -1541,6 +1518,10 @@ static int __init vhci_hcd_init(void) if (vhcis == NULL) return -ENOMEM; + ret = vhci_init_attr_group(); + if (ret) + goto err_init_attr_group; + ret = platform_driver_register(&vhci_driver); if (ret) goto err_driver_register; @@ -1565,9 +1546,12 @@ static int __init vhci_hcd_init(void) return 0; + err_add_hcd: platform_driver_unregister(&vhci_driver); err_driver_register: + vhci_finish_attr_group(); +err_init_attr_group: kfree(vhcis); return ret; } @@ -1576,6 +1560,7 @@ static void __exit vhci_hcd_exit(void) { del_platform_devices(); platform_driver_unregister(&vhci_driver); + vhci_finish_attr_group(); kfree(vhcis); } diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c index a7ede6fb3da9..8c0bff2ddabb 100644 --- a/drivers/usb/usbip/vhci_sysfs.c +++ b/drivers/usb/usbip/vhci_sysfs.c @@ -497,8 +497,27 @@ static void finish_status_attrs(void) kfree(status_attrs); } +static umode_t vhci_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int n) +{ + struct platform_device *pdev = to_platform_device(kobj_to_dev(kobj)); + /* + * The attributes control every controller and have always lived on + * vhci_hcd.0 only. Keep them there now that the driver core creates + * the group for each device. + */ + return pdev->id == 0 ? attr->mode : 0; +} + + struct attribute_group vhci_attr_group = { .attrs = NULL, + .is_visible = vhci_attr_is_visible, +}; + +const struct attribute_group *vhci_groups[] = { + &vhci_attr_group, + NULL, }; int vhci_init_attr_group(void) -- 2.43.0