* [syzbot] [usb?] general protection fault in bus_remove_device
@ 2026-08-19 17:18 syzbot
2026-08-20 4:34 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
` (11 more replies)
0 siblings, 12 replies; 14+ messages in thread
From: syzbot @ 2026-08-19 17:18 UTC (permalink / raw)
To: dakr, driver-core, gregkh, linux-kernel, linux-usb, rafael,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 15ef2f78c49d Merge tag 'input-for-v7.2-rc7' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11b16949580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1d67342c314f228d
dashboard link: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1198b279580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1598b279580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-15ef2f78.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dc9c417e94c9/vmlinux-15ef2f78.xz
kernel image: https://storage.googleapis.com/syzbot-assets/db592e5f65db/bzImage-15ef2f78.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
usb 5-1: selecting invalid altsetting 0
usb 5-1: USB disconnect, device number 2
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 1 UID: 0 PID: 29 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: usb_hub_wq hub_event
RIP: 0010:klist_put+0x4d/0x1d0 lib/klist.c:212
Code: c1 ea 03 80 3c 02 00 0f 85 74 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 43 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 7c 10 0d
RSP: 0018:ffffc90000687620 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888036142880 RCX: 0000000000000000
RDX: 000000000000000b RSI: ffffffff8bb263a5 RDI: 0000000000000058
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff2247f98
R10: ffffffff9123fcc3 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffffff9123fc80 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880d5cde000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff41160ff4 CR3: 0000000033bb7000 CR4: 0000000000352ef0
Call Trace:
<TASK>
klist_del lib/klist.c:230 [inline]
klist_remove+0x14c/0x2e0 lib/klist.c:249
__device_release_driver drivers/base/dd.c:1357 [inline]
device_release_driver_internal+0x4fb/0x620 drivers/base/dd.c:1372
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664
device_del+0x376/0x9b0 drivers/base/core.c:3961
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5415 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
port_event drivers/usb/core/hub.c:5879 [inline]
hub_event+0x1bb1/0x4420 drivers/usb/core/hub.c:5961
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:klist_put+0x4d/0x1d0 lib/klist.c:212
Code: c1 ea 03 80 3c 02 00 0f 85 74 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 83 e4 fe 49 8d 7c 24 58 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 43 01 00 00 4c 89 e7 4d 8b 74 24 58 e8 7c 10 0d
RSP: 0018:ffffc90000687620 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888036142880 RCX: 0000000000000000
RDX: 000000000000000b RSI: ffffffff8bb263a5 RDI: 0000000000000058
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff2247f98
R10: ffffffff9123fcc3 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffffffff9123fc80 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880d5cde000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff41160ff4 CR3: 000000002ccae000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: c1 ea 03 shr $0x3,%edx
3: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
7: 0f 85 74 01 00 00 jne 0x181
d: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
14: fc ff df
17: 4c 8b 23 mov (%rbx),%r12
1a: 49 83 e4 fe and $0xfffffffffffffffe,%r12
1e: 49 8d 7c 24 58 lea 0x58(%r12),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 43 01 00 00 jne 0x177
34: 4c 89 e7 mov %r12,%rdi
37: 4d 8b 74 24 58 mov 0x58(%r12),%r14
3c: e8 .byte 0xe8
3d: 7c 10 jl 0x4f
3f: 0d .byte 0xd
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
@ 2026-08-20 4:34 ` syzbot
2026-08-20 5:30 ` [syzbot] [usb?] general protection fault in bus_remove_device Edward Adam Davis
` (10 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-08-20 4:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] driver core: avoid klist_remove() on unattached knode_driver
Author: khiemtranzo532001@gmail.com
#syz test
usb_driver_claim_interface() sets dev->driver directly and skips
device_bind_driver() when the interface is not yet registered, so the
device can reach teardown with dev->driver set but knode_driver never
added to the driver's klist_devices. __device_release_driver() then
unconditionally calls klist_remove() on the unattached node, which
dereferences a NULL klist pointer in klist_put() and crashes.
Guard the klist_remove() with klist_node_attached(), mirroring the
existing check in bus_remove_device() for knode_bus.
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/base/dd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223..14752a5e5 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1354,7 +1354,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
device_unbind_cleanup(dev);
device_links_driver_cleanup(dev);
- klist_remove(&dev->p->knode_driver);
+ if (klist_node_attached(&dev->p->knode_driver))
+ klist_remove(&dev->p->knode_driver);
device_pm_check_callbacks(dev);
bus_notify(dev, BUS_NOTIFY_UNBOUND_DRIVER);
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] general protection fault in bus_remove_device
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
2026-08-20 4:34 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
@ 2026-08-20 5:30 ` Edward Adam Davis
2026-08-20 6:03 ` syzbot
2026-08-20 6:11 ` [PATCH] driver core: Do not remove the knode driver when autoprobe is disabled Edward Adam Davis
` (9 subsequent siblings)
11 siblings, 1 reply; 14+ messages in thread
From: Edward Adam Davis @ 2026-08-20 5:30 UTC (permalink / raw)
To: syzbot+87188222c77c0dbbdb4d; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223844..4154b44990b2 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1354,7 +1354,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
device_unbind_cleanup(dev);
device_links_driver_cleanup(dev);
- klist_remove(&dev->p->knode_driver);
+ if (device_is_bound(dev))
+ klist_remove(&dev->p->knode_driver);
device_pm_check_callbacks(dev);
bus_notify(dev, BUS_NOTIFY_UNBOUND_DRIVER);
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [usb?] general protection fault in bus_remove_device
2026-08-20 5:30 ` [syzbot] [usb?] general protection fault in bus_remove_device Edward Adam Davis
@ 2026-08-20 6:03 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-08-20 6:03 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Tested-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Tested on:
commit: a4ff2be3 Merge tag 'v7.3-p1' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10b4f815580000
kernel config: https://syzkaller.appspot.com/x/.config?x=29686c02180e4e86
dashboard link: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=16faa549580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH] driver core: Do not remove the knode driver when autoprobe is disabled
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
2026-08-20 4:34 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
2026-08-20 5:30 ` [syzbot] [usb?] general protection fault in bus_remove_device Edward Adam Davis
@ 2026-08-20 6:11 ` Edward Adam Davis
2026-08-20 6:13 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
` (8 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Edward Adam Davis @ 2026-08-20 6:11 UTC (permalink / raw)
To: syzbot+87188222c77c0dbbdb4d
Cc: dakr, driver-core, gregkh, linux-kernel, linux-usb, rafael,
syzkaller-bugs
After the user writes 0 to /sys/bus/usb/drivers_autoprobe, the USB device
fails to undergo the probe process, and the user does not manually perform
a bind operation.
Consequently, the corresponding driver is not bound to the device; this
leads to the removal of `dev->p->knode_driver` during driver release upon
usb device disconnection, triggering [1].
Add a check for knode_driver before removing it.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
Call Trace:
klist_del lib/klist.c:230 [inline]
klist_remove+0x14c/0x2e0 lib/klist.c:249
__device_release_driver drivers/base/dd.c:1357 [inline]
device_release_driver_internal+0x4fb/0x620 drivers/base/dd.c:1372
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664
device_del+0x376/0x9b0 drivers/base/core.c:3961
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5415 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
port_event drivers/usb/core/hub.c:5879 [inline]
hub_event+0x1bb1/0x4420 drivers/usb/core/hub.c:5961
Fixes: 94e7b1c5ff20 ("[PATCH] Add a klist to struct device_driver for the devices bound to it.")
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Tested-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
drivers/base/dd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223844..4154b44990b2 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1354,7 +1354,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
device_unbind_cleanup(dev);
device_links_driver_cleanup(dev);
- klist_remove(&dev->p->knode_driver);
+ if (device_is_bound(dev))
+ klist_remove(&dev->p->knode_driver);
device_pm_check_callbacks(dev);
bus_notify(dev, BUS_NOTIFY_UNBOUND_DRIVER);
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (2 preceding siblings ...)
2026-08-20 6:11 ` [PATCH] driver core: Do not remove the knode driver when autoprobe is disabled Edward Adam Davis
@ 2026-08-20 6:13 ` syzbot
2026-09-03 6:37 ` Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration syzbot
` (7 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-08-20 6:13 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] driver core: avoid klist_remove() on unattached knode_driver
Author: khiemtranzo532001@gmail.com
#syz test
usb_driver_claim_interface() sets dev->driver directly and skips
device_bind_driver() when the interface is not yet registered, so the
device can reach teardown with dev->driver set but knode_driver never
added to the driver's klist_devices. __device_release_driver() then
unconditionally calls klist_remove() on the unattached node, which
dereferences a NULL klist pointer in klist_put() and crashes.
Only remove the node if the device is actually bound, mirroring the
check device_is_bound() already provides for the driver core. This
matches the existing guard on knode_bus in bus_remove_device().
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/base/dd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 60c005223..4154b4499 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1354,7 +1354,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
device_unbind_cleanup(dev);
device_links_driver_cleanup(dev);
- klist_remove(&dev->p->knode_driver);
+ if (device_is_bound(dev))
+ klist_remove(&dev->p->knode_driver);
device_pm_check_callbacks(dev);
bus_notify(dev, BUS_NOTIFY_UNBOUND_DRIVER);
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (3 preceding siblings ...)
2026-08-20 6:13 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
@ 2026-09-03 6:37 ` syzbot
2026-09-03 6:46 ` syzbot
` (6 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 6:37 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test
usb_driver_claim_interface() sets dev->driver unconditionally before
checking device_is_registered(dev). When called from usb_audio_probe()
during configuration, the interface device has not been added to the
driver core yet (device_add() is called later in usb_set_configuration()).
As a result, knode_driver is never attached to the driver's klist, but
dev->driver is set. On subsequent disconnect, bus_remove_device() calls
__device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
unconditionally on the uninitialized node, causing a general protection
fault:
BUG: kernel NULL pointer dereference
RIP: klist_remove+0x...
Call Trace:
__device_release_driver
bus_remove_device
device_del
usb_disable_device
usb_disconnect
Fix this by deferring the assignment of dev->driver for interfaces that
are not yet registered. Instead, record the claim via two new fields in
struct usb_interface: a claimed bitflag and a claimed_driver pointer.
After device_add() completes in usb_set_configuration(), call
device_bind_driver() explicitly for claimed interfaces.
device_bind_driver() skips ->probe() (which is exactly what usb_audio
needs — PCM and MIDI devices are created before bind), but it does
attach knode_driver to the driver's klist, making teardown safe.
The else-if branch in dd.c that handles dev->driver already set at
device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
others) is intentionally left untouched.
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/core/driver.c | 19 ++++++++++++++-----
drivers/usb/core/message.c | 15 +++++++++++++++
include/linux/usb.h | 2 ++
3 files changed, 31 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is
safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after
reset */
unsigned authorized:1; /* used for interface authorization
*/
+ unsigned claimed:1; /* driver claimed before
device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind
*/
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
On Thu, Sep 3, 2026 at 1:30 PM Akihiko Kai <khiemtranzo532001@gmail.com>
wrote:
> usb_driver_claim_interface() sets dev->driver unconditionally before
> checking device_is_registered(dev). When called from usb_audio_probe()
> during configuration, the interface device has not been added to the
> driver core yet (device_add() is called later in usb_set_configuration()).
>
> As a result, knode_driver is never attached to the driver's klist, but
> dev->driver is set. On subsequent disconnect, bus_remove_device() calls
> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
> unconditionally on the uninitialized node, causing a general protection
> fault:
>
> BUG: kernel NULL pointer dereference
> RIP: klist_remove+0x...
> Call Trace:
> __device_release_driver
> bus_remove_device
> device_del
> usb_disable_device
> usb_disconnect
>
> Fix this by deferring the assignment of dev->driver for interfaces that
> are not yet registered. Instead, record the claim via two new fields in
> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
> After device_add() completes in usb_set_configuration(), call
> device_bind_driver() explicitly for claimed interfaces.
>
> device_bind_driver() skips ->probe() (which is exactly what usb_audio
> needs — PCM and MIDI devices are created before bind), but it does
> attach knode_driver to the driver's klist, making teardown safe.
>
> The else-if branch in dd.c that handles dev->driver already set at
> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
> others) is intentionally left untouched.
>
> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
> ---
> drivers/usb/core/driver.c | 19 ++++++++++++++-----
> drivers/usb/core/message.c | 15 +++++++++++++++
> include/linux/usb.h | 2 ++
> 3 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index f63004417..59e74872b 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> if (!iface->authorized)
> return -ENODEV;
>
> - dev->driver = &driver->driver;
> usb_set_intfdata(iface, data);
> iface->needs_binding = 0;
>
> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> else
> pm_runtime_set_active(dev);
>
> - /* if interface was already added, bind now; else let
> - * the future device_add() bind it, bypassing probe()
> - */
> - if (device_is_registered(dev))
> + if (device_is_registered(dev)) {
> + dev->driver = &driver->driver;
> retval = device_bind_driver(dev);
> + } else {
> + /*
> + * Interface not yet registered: record the claim without
> + * setting dev->driver. usb_set_configuration() will call
> + * device_bind_driver() explicitly after device_add(),
> which
> + * skips ->probe() and attaches knode_driver so teardown
> is safe.
> + */
> + iface->claimed = 1;
> + iface->claimed_driver = driver;
> + }
>
> if (retval) {
> dev->driver = NULL;
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd74..73c630750 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
> int configuration)
> if (ret != 0) {
> dev_err(&dev->dev, "device_add(%s) --> %d\n",
> dev_name(&intf->dev), ret);
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> continue;
> }
> + if (intf->claimed) {
> + intf->dev.driver = &intf->claimed_driver->driver;
> + ret = device_bind_driver(&intf->dev);
> + if (ret) {
> + dev_err(&dev->dev,
> + "device_bind_driver(%s) --> %d\n",
> + dev_name(&intf->dev), ret);
> + intf->dev.driver = NULL;
> + intf->condition = USB_INTERFACE_UNBOUND;
> + }
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> + }
> create_intf_ep_devs(intf);
> }
>
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 1da4ad161..0ec743e76 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -266,6 +266,8 @@ struct usb_interface {
> unsigned needs_binding:1; /* needs delayed unbind/rebind */
> unsigned resetting_device:1; /* true: bandwidth alloc after
> reset */
> unsigned authorized:1; /* used for interface
> authorization */
> + unsigned claimed:1; /* driver claimed before
> device_add() */
> + struct usb_driver *claimed_driver; /* driver for deferred
> bind */
> enum usb_wireless_status wireless_status;
> struct work_struct wireless_status_work;
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (4 preceding siblings ...)
2026-09-03 6:37 ` Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration syzbot
@ 2026-09-03 6:46 ` syzbot
2026-09-03 6:48 ` syzbot
` (5 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 6:46 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is
safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after
reset */
unsigned authorized:1; /* used for interface authorization
*/
+ unsigned claimed:1; /* driver claimed before
device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind
*/
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
On Thu, Sep 3, 2026 at 1:37 PM Akihiko Kai <khiemtranzo532001@gmail.com>
wrote:
> #syz test
>
> usb_driver_claim_interface() sets dev->driver unconditionally before
> checking device_is_registered(dev). When called from usb_audio_probe()
> during configuration, the interface device has not been added to the
> driver core yet (device_add() is called later in usb_set_configuration()).
>
> As a result, knode_driver is never attached to the driver's klist, but
> dev->driver is set. On subsequent disconnect, bus_remove_device() calls
> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
> unconditionally on the uninitialized node, causing a general protection
> fault:
>
> BUG: kernel NULL pointer dereference
> RIP: klist_remove+0x...
> Call Trace:
> __device_release_driver
> bus_remove_device
> device_del
> usb_disable_device
> usb_disconnect
>
> Fix this by deferring the assignment of dev->driver for interfaces that
> are not yet registered. Instead, record the claim via two new fields in
> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
> After device_add() completes in usb_set_configuration(), call
> device_bind_driver() explicitly for claimed interfaces.
>
> device_bind_driver() skips ->probe() (which is exactly what usb_audio
> needs — PCM and MIDI devices are created before bind), but it does
> attach knode_driver to the driver's klist, making teardown safe.
>
> The else-if branch in dd.c that handles dev->driver already set at
> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
> others) is intentionally left untouched.
>
> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
> ---
> drivers/usb/core/driver.c | 19 ++++++++++++++-----
> drivers/usb/core/message.c | 15 +++++++++++++++
> include/linux/usb.h | 2 ++
> 3 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index f63004417..59e74872b 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> if (!iface->authorized)
> return -ENODEV;
>
> - dev->driver = &driver->driver;
> usb_set_intfdata(iface, data);
> iface->needs_binding = 0;
>
> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
> else
> pm_runtime_set_active(dev);
>
> - /* if interface was already added, bind now; else let
> - * the future device_add() bind it, bypassing probe()
> - */
> - if (device_is_registered(dev))
> + if (device_is_registered(dev)) {
> + dev->driver = &driver->driver;
> retval = device_bind_driver(dev);
> + } else {
> + /*
> + * Interface not yet registered: record the claim without
> + * setting dev->driver. usb_set_configuration() will call
> + * device_bind_driver() explicitly after device_add(),
> which
> + * skips ->probe() and attaches knode_driver so teardown
> is safe.
> + */
> + iface->claimed = 1;
> + iface->claimed_driver = driver;
> + }
>
> if (retval) {
> dev->driver = NULL;
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd74..73c630750 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
> int configuration)
> if (ret != 0) {
> dev_err(&dev->dev, "device_add(%s) --> %d\n",
> dev_name(&intf->dev), ret);
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> continue;
> }
> + if (intf->claimed) {
> + intf->dev.driver = &intf->claimed_driver->driver;
> + ret = device_bind_driver(&intf->dev);
> + if (ret) {
> + dev_err(&dev->dev,
> + "device_bind_driver(%s) --> %d\n",
> + dev_name(&intf->dev), ret);
> + intf->dev.driver = NULL;
> + intf->condition = USB_INTERFACE_UNBOUND;
> + }
> + intf->claimed = 0;
> + intf->claimed_driver = NULL;
> + }
> create_intf_ep_devs(intf);
> }
>
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 1da4ad161..0ec743e76 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -266,6 +266,8 @@ struct usb_interface {
> unsigned needs_binding:1; /* needs delayed unbind/rebind */
> unsigned resetting_device:1; /* true: bandwidth alloc after
> reset */
> unsigned authorized:1; /* used for interface
> authorization */
> + unsigned claimed:1; /* driver claimed before
> device_add() */
> + struct usb_driver *claimed_driver; /* driver for deferred
> bind */
> enum usb_wireless_status wireless_status;
> struct work_struct wireless_status_work;
> --
> 2.34.1
>
> On Thu, Sep 3, 2026 at 1:30 PM Akihiko Kai <khiemtranzo532001@gmail.com>
> wrote:
>
>> usb_driver_claim_interface() sets dev->driver unconditionally before
>> checking device_is_registered(dev). When called from usb_audio_probe()
>> during configuration, the interface device has not been added to the
>> driver core yet (device_add() is called later in usb_set_configuration()).
>>
>> As a result, knode_driver is never attached to the driver's klist, but
>> dev->driver is set. On subsequent disconnect, bus_remove_device() calls
>> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
>> unconditionally on the uninitialized node, causing a general protection
>> fault:
>>
>> BUG: kernel NULL pointer dereference
>> RIP: klist_remove+0x...
>> Call Trace:
>> __device_release_driver
>> bus_remove_device
>> device_del
>> usb_disable_device
>> usb_disconnect
>>
>> Fix this by deferring the assignment of dev->driver for interfaces that
>> are not yet registered. Instead, record the claim via two new fields in
>> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
>> After device_add() completes in usb_set_configuration(), call
>> device_bind_driver() explicitly for claimed interfaces.
>>
>> device_bind_driver() skips ->probe() (which is exactly what usb_audio
>> needs — PCM and MIDI devices are created before bind), but it does
>> attach knode_driver to the driver's klist, making teardown safe.
>>
>> The else-if branch in dd.c that handles dev->driver already set at
>> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
>> others) is intentionally left untouched.
>>
>> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
>> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
>> ---
>> drivers/usb/core/driver.c | 19 ++++++++++++++-----
>> drivers/usb/core/message.c | 15 +++++++++++++++
>> include/linux/usb.h | 2 ++
>> 3 files changed, 31 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
>> index f63004417..59e74872b 100644
>> --- a/drivers/usb/core/driver.c
>> +++ b/drivers/usb/core/driver.c
>> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>> if (!iface->authorized)
>> return -ENODEV;
>>
>> - dev->driver = &driver->driver;
>> usb_set_intfdata(iface, data);
>> iface->needs_binding = 0;
>>
>> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>> else
>> pm_runtime_set_active(dev);
>>
>> - /* if interface was already added, bind now; else let
>> - * the future device_add() bind it, bypassing probe()
>> - */
>> - if (device_is_registered(dev))
>> + if (device_is_registered(dev)) {
>> + dev->driver = &driver->driver;
>> retval = device_bind_driver(dev);
>> + } else {
>> + /*
>> + * Interface not yet registered: record the claim without
>> + * setting dev->driver. usb_set_configuration() will call
>> + * device_bind_driver() explicitly after device_add(),
>> which
>> + * skips ->probe() and attaches knode_driver so teardown
>> is safe.
>> + */
>> + iface->claimed = 1;
>> + iface->claimed_driver = driver;
>> + }
>>
>> if (retval) {
>> dev->driver = NULL;
>> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
>> index 75e2bfd74..73c630750 100644
>> --- a/drivers/usb/core/message.c
>> +++ b/drivers/usb/core/message.c
>> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
>> int configuration)
>> if (ret != 0) {
>> dev_err(&dev->dev, "device_add(%s) --> %d\n",
>> dev_name(&intf->dev), ret);
>> + intf->claimed = 0;
>> + intf->claimed_driver = NULL;
>> continue;
>> }
>> + if (intf->claimed) {
>> + intf->dev.driver = &intf->claimed_driver->driver;
>> + ret = device_bind_driver(&intf->dev);
>> + if (ret) {
>> + dev_err(&dev->dev,
>> + "device_bind_driver(%s) --> %d\n",
>> + dev_name(&intf->dev), ret);
>> + intf->dev.driver = NULL;
>> + intf->condition = USB_INTERFACE_UNBOUND;
>> + }
>> + intf->claimed = 0;
>> + intf->claimed_driver = NULL;
>> + }
>> create_intf_ep_devs(intf);
>> }
>>
>> diff --git a/include/linux/usb.h b/include/linux/usb.h
>> index 1da4ad161..0ec743e76 100644
>> --- a/include/linux/usb.h
>> +++ b/include/linux/usb.h
>> @@ -266,6 +266,8 @@ struct usb_interface {
>> unsigned needs_binding:1; /* needs delayed unbind/rebind */
>> unsigned resetting_device:1; /* true: bandwidth alloc after
>> reset */
>> unsigned authorized:1; /* used for interface
>> authorization */
>> + unsigned claimed:1; /* driver claimed before
>> device_add() */
>> + struct usb_driver *claimed_driver; /* driver for deferred
>> bind */
>> enum usb_wireless_status wireless_status;
>> struct work_struct wireless_status_work;
>> --
>> 2.34.1
>>
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (5 preceding siblings ...)
2026-09-03 6:46 ` syzbot
@ 2026-09-03 6:48 ` syzbot
2026-09-03 6:52 ` syzbot
` (4 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 6:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is
safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after
reset */
unsigned authorized:1; /* used for interface authorization
*/
+ unsigned claimed:1; /* driver claimed before
device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind
*/
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (6 preceding siblings ...)
2026-09-03 6:48 ` syzbot
@ 2026-09-03 6:52 ` syzbot
2026-09-03 6:59 ` syzbot
` (3 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 6:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test
usb_driver_claim_interface() sets dev->driver unconditionally before
checking device_is_registered(dev). When called from usb_audio_probe()
during configuration, the interface device has not been added to the
driver core yet (device_add() is called later in usb_set_configuration()).
As a result, knode_driver is never attached to the driver's klist, but
dev->driver is set. On subsequent disconnect, bus_remove_device() calls
__device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
unconditionally on the uninitialized node, causing a general protection
fault:
BUG: kernel NULL pointer dereference
RIP: klist_remove+0x...
Call Trace:
__device_release_driver
bus_remove_device
device_del
usb_disable_device
usb_disconnect
Fix this by deferring the assignment of dev->driver for interfaces that
are not yet registered. Instead, record the claim via two new fields in
struct usb_interface: a claimed bitflag and a claimed_driver pointer.
After device_add() completes in usb_set_configuration(), call
device_bind_driver() explicitly for claimed interfaces.
device_bind_driver() skips ->probe() (which is exactly what usb_audio
needs — PCM and MIDI devices are created before bind), but it does
attach knode_driver to the driver's klist, making teardown safe.
The else-if branch in dd.c that handles dev->driver already set at
device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
others) is intentionally left untouched.
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/core/driver.c | 19 ++++++++++++++-----
drivers/usb/core/message.c | 15 +++++++++++++++
include/linux/usb.h | 2 ++
3 files changed, 31 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is
safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after
reset */
unsigned authorized:1; /* used for interface authorization
*/
+ unsigned claimed:1; /* driver claimed before
device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind
*/
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (7 preceding siblings ...)
2026-09-03 6:52 ` syzbot
@ 2026-09-03 6:59 ` syzbot
2026-09-03 7:02 ` syzbot
` (2 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 6:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
usb_driver_claim_interface() sets dev->driver unconditionally before
checking device_is_registered(dev). When called from usb_audio_probe()
during configuration, the interface device has not been added to the
driver core yet (device_add() is called later in usb_set_configuration()).
As a result, knode_driver is never attached to the driver's klist, but
dev->driver is set. On subsequent disconnect, bus_remove_device() calls
__device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
unconditionally on the uninitialized node, causing a general protection
fault:
BUG: kernel NULL pointer dereference
RIP: klist_remove+0x...
Call Trace:
__device_release_driver
bus_remove_device
device_del
usb_disable_device
usb_disconnect
Fix this by deferring the assignment of dev->driver for interfaces that
are not yet registered. Instead, record the claim via two new fields in
struct usb_interface: a claimed bitflag and a claimed_driver pointer.
After device_add() completes in usb_set_configuration(), call
device_bind_driver() explicitly for claimed interfaces.
device_bind_driver() skips ->probe() (which is exactly what usb_audio
needs — PCM and MIDI devices are created before bind), but it does
attach knode_driver to the driver's klist, making teardown safe.
The else-if branch in dd.c that handles dev->driver already set at
device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
others) is intentionally left untouched.
Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/core/driver.c | 19 ++++++++++++++-----
drivers/usb/core/message.c | 15 +++++++++++++++
include/linux/usb.h | 2 ++
3 files changed, 31 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver *driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so
teardown is safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device
*dev, int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after reset */
unsigned authorized:1; /* used for interface authorization */
+ unsigned claimed:1; /* driver claimed before device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind */
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (8 preceding siblings ...)
2026-09-03 6:59 ` syzbot
@ 2026-09-03 7:02 ` syzbot
2026-09-03 7:06 ` syzbot
2026-09-03 7:11 ` syzbot
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 7:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver *driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so
teardown is safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device
*dev, int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after reset */
unsigned authorized:1; /* used for interface authorization */
+ unsigned claimed:1; /* driver claimed before device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind */
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (9 preceding siblings ...)
2026-09-03 7:02 ` syzbot
@ 2026-09-03 7:06 ` syzbot
2026-09-03 7:11 ` syzbot
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 7:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver *driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after reset */
unsigned authorized:1; /* used for interface authorization */
+ unsigned claimed:1; /* driver claimed before device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind */
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
` (10 preceding siblings ...)
2026-09-03 7:06 ` syzbot
@ 2026-09-03 7:11 ` syzbot
11 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-09-03 7:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
if (!iface->authorized)
return -ENODEV;
- dev->driver = &driver->driver;
usb_set_intfdata(iface, data);
iface->needs_binding = 0;
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver *driver,
else
pm_runtime_set_active(dev);
- /* if interface was already added, bind now; else let
- * the future device_add() bind it, bypassing probe()
- */
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ dev->driver = &driver->driver;
retval = device_bind_driver(dev);
+ } else {
+ /*
+ * Interface not yet registered: record the claim without
+ * setting dev->driver. usb_set_configuration() will call
+ * device_bind_driver() explicitly after device_add(), which
+ * skips ->probe() and attaches knode_driver so teardown is safe.
+ */
+ iface->claimed = 1;
+ iface->claimed_driver = driver;
+ }
if (retval) {
dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
continue;
}
+ if (intf->claimed) {
+ intf->dev.driver = &intf->claimed_driver->driver;
+ ret = device_bind_driver(&intf->dev);
+ if (ret) {
+ dev_err(&dev->dev,
+ "device_bind_driver(%s) --> %d\n",
+ dev_name(&intf->dev), ret);
+ intf->dev.driver = NULL;
+ intf->condition = USB_INTERFACE_UNBOUND;
+ }
+ intf->claimed = 0;
+ intf->claimed_driver = NULL;
+ }
create_intf_ep_devs(intf);
}
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
unsigned needs_binding:1; /* needs delayed unbind/rebind */
unsigned resetting_device:1; /* true: bandwidth alloc after reset */
unsigned authorized:1; /* used for interface authorization */
+ unsigned claimed:1; /* driver claimed before device_add() */
+ struct usb_driver *claimed_driver; /* driver for deferred bind */
enum usb_wireless_status wireless_status;
struct work_struct wireless_status_work;
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2026-09-03 7:11 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-19 17:18 [syzbot] [usb?] general protection fault in bus_remove_device syzbot
2026-08-20 4:34 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
2026-08-20 5:30 ` [syzbot] [usb?] general protection fault in bus_remove_device Edward Adam Davis
2026-08-20 6:03 ` syzbot
2026-08-20 6:11 ` [PATCH] driver core: Do not remove the knode driver when autoprobe is disabled Edward Adam Davis
2026-08-20 6:13 ` Forwarded: [PATCH] driver core: avoid klist_remove() on unattached knode_driver syzbot
2026-09-03 6:37 ` Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration syzbot
2026-09-03 6:46 ` syzbot
2026-09-03 6:48 ` syzbot
2026-09-03 6:52 ` syzbot
2026-09-03 6:59 ` syzbot
2026-09-03 7:02 ` syzbot
2026-09-03 7:06 ` syzbot
2026-09-03 7:11 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®