All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: valentina.manea.m@gmail.com, shuah@kernel.org, i@zenithal.me,
	linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzbot+8753715f05759f1a10de@syzkaller.appspotmail.com
Subject: Re: [PATCH] usbip: vhci_hcd: move sysfs attribute setup into probe/remove
Date: Sun, 16 Aug 2026 00:30:41 +0900	[thread overview]
Message-ID: <2026081618-october-hungry-39a0@gregkh> (raw)
In-Reply-To: <20260815143427.19066-1-kartikey406@gmail.com>

On Sat, Aug 15, 2026 at 08:04:27PM +0530, Deepanshu Kartikey wrote:
> 
> The vhci sysfs attribute group is created in vhci_start() and removed in
> vhci_stop(), guarded by usb_hcd_is_primary_hcd(). Since vhci_start() and
> vhci_stop() run from usb_add_hcd()/usb_remove_hcd(), which are each called
> twice, the attach attribute is live while only one of the two hcds exists:
> it is created during the first usb_add_hcd() before vhci_hcd_ss is set,
> and it survives the first usb_put_hcd() during removal. A concurrent write
> to attach can therefore reach a NULL or freed vhci_hcd_ss.
> 
> Create the group at the end of vhci_hcd_probe(), after both hcds are
> added, and remove it at the start of vhci_hcd_remove(), before either
> reference is dropped. sysfs_remove_group() drains in-flight store
> callbacks, so no writer can be inside attach_store() once it returns.

If you are going to move the creation, please do so in a race-free way
and properly make the driver core control this by setting these up as
default attributes.

A huge hint that something is wrong in a driver is when it calls a
sysfs_*() function, like this.  That's not ok, so either it is doing
something out-of-the-ordinary and it requires it, or it's broken.

WHat has recently changed to make this start to fail now to require this
change?

thanks,

greg k-h

  reply	other threads:[~2026-08-15 15:32 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-15 14:34 [PATCH] usbip: vhci_hcd: move sysfs attribute setup into probe/remove Deepanshu Kartikey
2026-08-15 15:30 ` Greg KH [this message]
2026-08-16  1:57   ` Deepanshu Kartikey
  -- strict thread matches above, loose matches on Subject: below --
2026-08-15 14:32 Deepanshu Kartikey

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2026081618-october-hungry-39a0@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=i@zenithal.me \
    --cc=kartikey406@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=shuah@kernel.org \
    --cc=syzbot+8753715f05759f1a10de@syzkaller.appspotmail.com \
    --cc=valentina.manea.m@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.