Re: [PATCH] usbip: fix use-after-free in event_handler()

[Shuah Khan <skhan@linuxfoundation.org>]

On 8/11/26 07:07, Aleksandr Nogikh wrote:
> On Mon, Aug 10, 2026 at 9:33 PM Shuah Khan <skhan@linuxfoundation.org> wrote:
>>
> < ... >
>>>
>>> During unbinding, we must wait for the scheduled removal event to
>>> finish before we can safely free the device structures. From what I
>>> see in the code, once we have reached wait_event_interruptible(),
>>> there's no way to abort the process or somehow gracefully handle the
>>> error.
>>>
>>
>> Yes I agree with you on rewinding being hard.
>>
>> Care to explain the scope of this assist?
>>
>> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> 
> It was generated by the syzbot's AI patch generation agent:
> https://github.com/google/syzkaller/blob/master/docs/syzbot_ai_patches.md
> 
> We manually review the patches it suggests and upstream those we
> believe are fully correct.
> 

As you are reviewing this generated code, did you look into scenarios
where the driver to hang in wait_event()?

thanks,
-- Shuah