From: Danilo Krummrich <dakr@kernel.org>
To: Gary Guo <gary@garyguo.net>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
"Toke Høiland-Jørgensen" <toke@toke.dk>,
"Johan Hovold" <johan@kernel.org>,
"Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Petko Manolov" <petkan@nucleusys.com>,
"Andrew Lunn" <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Chas Williams" <3chas3@gmail.com>,
"Alan Stern" <stern@rowland.harvard.edu>,
linux-usb@vger.kernel.org, driver-core@lists.linux.dev,
linux-wireless@vger.kernel.org, linux-media@vger.kernel.org,
linux-atm-general@lists.sourceforge.net, netdev@vger.kernel.org,
usb-storage@lists.one-eyed-alien.net,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 7/7] usb: fix UAF when probe runs concurrent to dyn ID removal
Date: Tue, 7 Jul 2026 15:41:31 +0200 [thread overview]
Message-ID: <25951ecd-53e1-439e-92a2-8de3ff471d8a@kernel.org> (raw)
In-Reply-To: <20260707-usb_dyn_id_uaf-v2-7-632dcf3adfba@garyguo.net>
On 7/7/26 2:26 PM, Gary Guo wrote:
> Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
> as remove_id_store can free the node. Thus, make a copy in
> usb_probe_interface. Clarify the documentation that the id parameter is
> only valid during the probe.
>
> USB serial has the same pattern, but it does not need fixing as the IDs
> cannot be removed via sysfs.
>
> Fixes: 0c7a2b72746a ("USB: add remove_id sysfs attr for usb drivers")
> Signed-off-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
next prev parent reply other threads:[~2026-07-07 13:41 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-07 12:26 [PATCH v2 0/7] usb: fix UAF related to dynamic ID Gary Guo
2026-07-07 12:26 ` [PATCH v2 1/7] wifi: ath9k_htc: don't store usb_device_id Gary Guo
2026-07-07 12:26 ` [PATCH v2 2/7] usb: usbtmc: " Gary Guo
2026-07-07 12:26 ` [PATCH v2 3/7] usb: serial: spcp8x5: " Gary Guo
2026-07-07 12:26 ` [PATCH v2 4/7] media: as102: do not rely on id table address comparison Gary Guo
2026-07-07 12:26 ` [PATCH v2 5/7] net: usb: pegasus: don't rely on id table pointer arithmetic Gary Guo
2026-07-07 12:26 ` [PATCH v2 6/7] usb: xusbatm: " Gary Guo
2026-07-07 12:26 ` [PATCH v2 7/7] usb: fix UAF when probe runs concurrent to dyn ID removal Gary Guo
2026-07-07 13:41 ` Danilo Krummrich [this message]
2026-07-10 13:13 ` [PATCH v2 0/7] usb: fix UAF related to dynamic ID Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=25951ecd-53e1-439e-92a2-8de3ff471d8a@kernel.org \
--to=dakr@kernel.org \
--cc=3chas3@gmail.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=driver-core@lists.linux.dev \
--cc=edumazet@google.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-atm-general@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petkan@nucleusys.com \
--cc=rafael@kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=toke@toke.dk \
--cc=usb-storage@lists.one-eyed-alien.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.