From: syzbot <syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Date: Wed, 02 Sep 2026 23:46:31 -0700 [thread overview]
Message-ID: <6a9917c7.9266084e.bf0d7.00af.GAE@google.com> (raw)
In-Reply-To: <6a85e576.f7a79266.2f965f.003f.GAE@google.com>
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is
safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after
reset */
unsigned authorized:1; /* used for interface authorization
*/
+ unsigned claimed:1; /* driver claimed before
device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind
*/
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
On Thu, Sep 3, 2026 at 1:37 PM Akihiko Kai <khiemtranzo532001@gmail.com>
wrote:
> #syz test
>
> usb_driver_claim_interface() sets dev->driver unconditionally before
> checking device_is_registered(dev). When called from usb_audio_probe()
> during configuration, the interface device has not been added to the
> driver core yet (device_add() is called later in usb_set_configuration()).
>
> As a result, knode_driver is never attached to the driver's klist, but
> dev->driver is set. On subsequent disconnect, bus_remove_device() calls
> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
> unconditionally on the uninitialized node, causing a general protection
> fault:
>
> BUG: kernel NULL pointer dereference
> RIP: klist_remove+0x...
> Call Trace:
> __device_release_driver
> bus_remove_device
> device_del
> usb_disable_device
> usb_disconnect
>
> Fix this by deferring the assignment of dev->driver for interfaces that
> are not yet registered. Instead, record the claim via two new fields in
> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
> After device_add() completes in usb_set_configuration(), call
> device_bind_driver() explicitly for claimed interfaces.
>
> device_bind_driver() skips ->probe() (which is exactly what usb_audio
> needs — PCM and MIDI devices are created before bind), but it does
> attach knode_driver to the driver's klist, making teardown safe.
>
> The else-if branch in dd.c that handles dev->driver already set at
> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
> others) is intentionally left untouched.
>
> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
> ---
> drivers/usb/core/driver.c | 19 ++++++++++++++-----
> drivers/usb/core/message.c | 15 +++++++++++++++
> include/linux/usb.h | 2 ++
> 3 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index f63004417..59e74872b 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> if (!iface->authorized)
> return -ENODEV;
>
> - dev->driver = &driver->driver;
> usb_set_intfdata(iface, data);
> iface->needs_binding = 0;
>
> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> else
> pm_runtime_set_active(dev);
>
> - /* if interface was already added, bind now; else let
> - * the future device_add() bind it, bypassing probe()
> - */
> - if (device_is_registered(dev))
> + if (device_is_registered(dev)) {
> + dev->driver = &driver->driver;
> retval = device_bind_driver(dev);
> + } else {
> + /*
> + * Interface not yet registered: record the claim without
> + * setting dev->driver. usb_set_configuration() will call
> + * device_bind_driver() explicitly after device_add(),
> which
> + * skips ->probe() and attaches knode_driver so teardown
> is safe.
> + */
> + iface->claimed = 1;
> + iface->claimed_driver = driver;
> + }
>
> if (retval) {
> dev->driver = NULL;
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd74..73c630750 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
> int configuration)
> if (ret != 0) {
> dev_err(&dev->dev, "device_add(%s) --> %d\n",
> dev_name(&intf->dev), ret);
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> continue;
> }
> + if (intf->claimed) {
> + intf->dev.driver = &intf->claimed_driver->driver;
> + ret = device_bind_driver(&intf->dev);
> + if (ret) {
> + dev_err(&dev->dev,
> + "device_bind_driver(%s) --> %d\n",
> + dev_name(&intf->dev), ret);
> + intf->dev.driver = NULL;
> + intf->condition = USB_INTERFACE_UNBOUND;
> + }
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> + }
> create_intf_ep_devs(intf);
> }
>
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 1da4ad161..0ec743e76 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -266,6 +266,8 @@ struct usb_interface {
> unsigned needs_binding:1; /* needs delayed unbind/rebind */
> unsigned resetting_device:1; /* true: bandwidth alloc after
> reset */
> unsigned authorized:1; /* used for interface
> authorization */
> + unsigned claimed:1; /* driver claimed before
> device_add() */
> + struct usb_driver *claimed_driver; /* driver for deferred
> bind */
> enum usb_wireless_status wireless_status;
> struct work_struct wireless_status_work;
> --
> 2.34.1
>
> On Thu, Sep 3, 2026 at 1:30 PM Akihiko Kai <khiemtranzo532001@gmail.com>
> wrote:
>
>> usb_driver_claim_interface() sets dev->driver unconditionally before
>> checking device_is_registered(dev). When called from usb_audio_probe()
>> during configuration, the interface device has not been added to the
>> driver core yet (device_add() is called later in usb_set_configuration()).
>>
>> As a result, knode_driver is never attached to the driver's klist, but
>> dev->driver is set. On subsequent disconnect, bus_remove_device() calls
>> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
>> unconditionally on the uninitialized node, causing a general protection
>> fault:
>>
>> BUG: kernel NULL pointer dereference
>> RIP: klist_remove+0x...
>> Call Trace:
>> __device_release_driver
>> bus_remove_device
>> device_del
>> usb_disable_device
>> usb_disconnect
>>
>> Fix this by deferring the assignment of dev->driver for interfaces that
>> are not yet registered. Instead, record the claim via two new fields in
>> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
>> After device_add() completes in usb_set_configuration(), call
>> device_bind_driver() explicitly for claimed interfaces.
>>
>> device_bind_driver() skips ->probe() (which is exactly what usb_audio
>> needs — PCM and MIDI devices are created before bind), but it does
>> attach knode_driver to the driver's klist, making teardown safe.
>>
>> The else-if branch in dd.c that handles dev->driver already set at
>> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
>> others) is intentionally left untouched.
>>
>> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
>> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
>> ---
>> drivers/usb/core/driver.c | 19 ++++++++++++++-----
>> drivers/usb/core/message.c | 15 +++++++++++++++
>> include/linux/usb.h | 2 ++
>> 3 files changed, 31 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
>> index f63004417..59e74872b 100644
>> --- a/drivers/usb/core/driver.c
>> +++ b/drivers/usb/core/driver.c
>> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>> if (!iface->authorized)
>> return -ENODEV;
>>
>> - dev->driver = &driver->driver;
>> usb_set_intfdata(iface, data);
>> iface->needs_binding = 0;
>>
>> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>> else
>> pm_runtime_set_active(dev);
>>
>> - /* if interface was already added, bind now; else let
>> - * the future device_add() bind it, bypassing probe()
>> - */
>> - if (device_is_registered(dev))
>> + if (device_is_registered(dev)) {
>> + dev->driver = &driver->driver;
>> retval = device_bind_driver(dev);
>> + } else {
>> + /*
>> + * Interface not yet registered: record the claim without
>> + * setting dev->driver. usb_set_configuration() will call
>> + * device_bind_driver() explicitly after device_add(),
>> which
>> + * skips ->probe() and attaches knode_driver so teardown
>> is safe.
>> + */
>> + iface->claimed = 1;
>> + iface->claimed_driver = driver;
>> + }
>>
>> if (retval) {
>> dev->driver = NULL;
>> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
>> index 75e2bfd74..73c630750 100644
>> --- a/drivers/usb/core/message.c
>> +++ b/drivers/usb/core/message.c
>> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
>> int configuration)
>> if (ret != 0) {
>> dev_err(&dev->dev, "device_add(%s) --> %d\n",
>> dev_name(&intf->dev), ret);
>> + intf->claimed = 0;
>> + intf->claimed_driver = NULL;
>> continue;
>> }
>> + if (intf->claimed) {
>> + intf->dev.driver = &intf->claimed_driver->driver;
>> + ret = device_bind_driver(&intf->dev);
>> + if (ret) {
>> + dev_err(&dev->dev,
>> + "device_bind_driver(%s) --> %d\n",
>> + dev_name(&intf->dev), ret);
>> + intf->dev.driver = NULL;
>> + intf->condition = USB_INTERFACE_UNBOUND;
>> + }
>> + intf->claimed = 0;
>> + intf->claimed_driver = NULL;
>> + }
>> create_intf_ep_devs(intf);
>> }
>>
>> diff --git a/include/linux/usb.h b/include/linux/usb.h
>> index 1da4ad161..0ec743e76 100644
>> --- a/include/linux/usb.h
>> +++ b/include/linux/usb.h
>> @@ -266,6 +266,8 @@ struct usb_interface {
>> unsigned needs_binding:1; /* needs delayed unbind/rebind */
>> unsigned resetting_device:1; /* true: bandwidth alloc after
>> reset */
>> unsigned authorized:1; /* used for interface
>> authorization */
>> + unsigned claimed:1; /* driver claimed before
>> device_add() */
>> + struct usb_driver *claimed_driver; /* driver for deferred
>> bind */
>> enum usb_wireless_status wireless_status;
>> struct work_struct wireless_status_work;
>> --
>> 2.34.1
>>
>
next prev parent reply other threads:[~2026-09-03 6:46 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
2026-08-20 4:34 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
2026-08-20 5:30 ` [syzbot] [usb?] general protection fault in bus_remove_device Edward Adam Davis
2026-08-20 6:03 ` syzbot
2026-08-20 6:11 ` [PATCH] driver core: Do not remove the knode driver when autoprobe is disabled Edward Adam Davis
2026-08-20 6:13 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
2026-09-03 6:37 ` Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration syzbot
2026-09-03 6:46 ` syzbot [this message]
2026-09-03 6:48 ` syzbot
2026-09-03 6:52 ` syzbot
2026-09-03 6:59 ` syzbot
2026-09-03 7:02 ` syzbot
2026-09-03 7:06 ` syzbot
2026-09-03 7:11 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a9917c7.9266084e.bf0d7.00af.GAE@google.com \
--to=syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®