Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration

[syzbot <syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 	if (!iface->authorized)
 		return -ENODEV;
 
-	dev->driver = &driver->driver;
 	usb_set_intfdata(iface, data);
 	iface->needs_binding = 0;
 
@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 	else
 		pm_runtime_set_active(dev);
 
-	/* if interface was already added, bind now; else let
-	 * the future device_add() bind it, bypassing probe()
-	 */
-	if (device_is_registered(dev))
+	if (device_is_registered(dev)) {
+		dev->driver = &driver->driver;
 		retval = device_bind_driver(dev);
+	} else {
+		/*
+		 * Interface not yet registered: record the claim without
+		 * setting dev->driver.  usb_set_configuration() will call
+		 * device_bind_driver() explicitly after device_add(), which
+		 * skips ->probe() and attaches knode_driver so teardown is safe.
+		 */
+		iface->claimed = 1;
+		iface->claimed_driver = driver;
+	}
 
 	if (retval) {
 		dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		if (ret != 0) {
 			dev_err(&dev->dev, "device_add(%s) --> %d\n",
 				dev_name(&intf->dev), ret);
+			intf->claimed = 0;
+			intf->claimed_driver = NULL;
 			continue;
 		}
+		if (intf->claimed) {
+			intf->dev.driver = &intf->claimed_driver->driver;
+			ret = device_bind_driver(&intf->dev);
+			if (ret) {
+				dev_err(&dev->dev,
+					"device_bind_driver(%s) --> %d\n",
+					dev_name(&intf->dev), ret);
+				intf->dev.driver = NULL;
+				intf->condition = USB_INTERFACE_UNBOUND;
+			}
+			intf->claimed = 0;
+			intf->claimed_driver = NULL;
+		}
 		create_intf_ep_devs(intf);
 	}
 
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
 	unsigned needs_binding:1;	/* needs delayed unbind/rebind */
 	unsigned resetting_device:1;	/* true: bandwidth alloc after reset */
 	unsigned authorized:1;		/* used for interface authorization */
+	unsigned claimed:1;		/* driver claimed before device_add() */
+	struct usb_driver *claimed_driver;	/* driver for deferred bind */
 	enum usb_wireless_status wireless_status;
 	struct work_struct wireless_status_work;