Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration

[syzbot <syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
        if (!iface->authorized)
                return -ENODEV;

-       dev->driver = &driver->driver;
        usb_set_intfdata(iface, data);
        iface->needs_binding = 0;

@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
        else
                pm_runtime_set_active(dev);

-       /* if interface was already added, bind now; else let
-        * the future device_add() bind it, bypassing probe()
-        */
-       if (device_is_registered(dev))
+       if (device_is_registered(dev)) {
+               dev->driver = &driver->driver;
                retval = device_bind_driver(dev);
+       } else {
+               /*
+                * Interface not yet registered: record the claim without
+                * setting dev->driver.  usb_set_configuration() will call
+                * device_bind_driver() explicitly after device_add(), which
+                * skips ->probe() and attaches knode_driver so teardown is
safe.
+                */
+               iface->claimed = 1;
+               iface->claimed_driver = driver;
+       }

        if (retval) {
                dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
                if (ret != 0) {
                        dev_err(&dev->dev, "device_add(%s) --> %d\n",
                                dev_name(&intf->dev), ret);
+                       intf->claimed = 0;
+                       intf->claimed_driver = NULL;
                        continue;
                }
+               if (intf->claimed) {
+                       intf->dev.driver = &intf->claimed_driver->driver;
+                       ret = device_bind_driver(&intf->dev);
+                       if (ret) {
+                               dev_err(&dev->dev,
+                                       "device_bind_driver(%s) --> %d\n",
+                                       dev_name(&intf->dev), ret);
+                               intf->dev.driver = NULL;
+                               intf->condition = USB_INTERFACE_UNBOUND;
+                       }
+                       intf->claimed = 0;
+                       intf->claimed_driver = NULL;
+               }
                create_intf_ep_devs(intf);
        }

diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
        unsigned needs_binding:1;       /* needs delayed unbind/rebind */
        unsigned resetting_device:1;    /* true: bandwidth alloc after
reset */
        unsigned authorized:1;          /* used for interface authorization
*/
+       unsigned claimed:1;             /* driver claimed before
device_add() */
+       struct usb_driver *claimed_driver;      /* driver for deferred bind
*/
        enum usb_wireless_status wireless_status;
        struct work_struct wireless_status_work;
--
2.34.1

On Thu, Sep 3, 2026 at 1:37 PM Akihiko Kai <khiemtranzo532001@gmail.com>
wrote:

> #syz test
>
> usb_driver_claim_interface() sets dev->driver unconditionally before
> checking device_is_registered(dev).  When called from usb_audio_probe()
> during configuration, the interface device has not been added to the
> driver core yet (device_add() is called later in usb_set_configuration()).
>
> As a result, knode_driver is never attached to the driver's klist, but
> dev->driver is set.  On subsequent disconnect, bus_remove_device() calls
> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
> unconditionally on the uninitialized node, causing a general protection
> fault:
>
>   BUG: kernel NULL pointer dereference
>   RIP: klist_remove+0x...
>   Call Trace:
>    __device_release_driver
>    bus_remove_device
>    device_del
>    usb_disable_device
>    usb_disconnect
>
> Fix this by deferring the assignment of dev->driver for interfaces that
> are not yet registered.  Instead, record the claim via two new fields in
> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
> After device_add() completes in usb_set_configuration(), call
> device_bind_driver() explicitly for claimed interfaces.
>
> device_bind_driver() skips ->probe() (which is exactly what usb_audio
> needs — PCM and MIDI devices are created before bind), but it does
> attach knode_driver to the driver's klist, making teardown safe.
>
> The else-if branch in dd.c that handles dev->driver already set at
> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
> others) is intentionally left untouched.
>
> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
> ---
>  drivers/usb/core/driver.c  | 19 ++++++++++++++-----
>  drivers/usb/core/message.c | 15 +++++++++++++++
>  include/linux/usb.h        |  2 ++
>  3 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index f63004417..59e74872b 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
>         if (!iface->authorized)
>                 return -ENODEV;
>
> -       dev->driver = &driver->driver;
>         usb_set_intfdata(iface, data);
>         iface->needs_binding = 0;
>
> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
>         else
>                 pm_runtime_set_active(dev);
>
> -       /* if interface was already added, bind now; else let
> -        * the future device_add() bind it, bypassing probe()
> -        */
> -       if (device_is_registered(dev))
> +       if (device_is_registered(dev)) {
> +               dev->driver = &driver->driver;
>                 retval = device_bind_driver(dev);
> +       } else {
> +               /*
> +                * Interface not yet registered: record the claim without
> +                * setting dev->driver.  usb_set_configuration() will call
> +                * device_bind_driver() explicitly after device_add(),
> which
> +                * skips ->probe() and attaches knode_driver so teardown
> is safe.
> +                */
> +               iface->claimed = 1;
> +               iface->claimed_driver = driver;
> +       }
>
>         if (retval) {
>                 dev->driver = NULL;
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd74..73c630750 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
> int configuration)
>                 if (ret != 0) {
>                         dev_err(&dev->dev, "device_add(%s) --> %d\n",
>                                 dev_name(&intf->dev), ret);
> +                       intf->claimed = 0;
> +                       intf->claimed_driver = NULL;
>                         continue;
>                 }
> +               if (intf->claimed) {
> +                       intf->dev.driver = &intf->claimed_driver->driver;
> +                       ret = device_bind_driver(&intf->dev);
> +                       if (ret) {
> +                               dev_err(&dev->dev,
> +                                       "device_bind_driver(%s) --> %d\n",
> +                                       dev_name(&intf->dev), ret);
> +                               intf->dev.driver = NULL;
> +                               intf->condition = USB_INTERFACE_UNBOUND;
> +                       }
> +                       intf->claimed = 0;
> +                       intf->claimed_driver = NULL;
> +               }
>                 create_intf_ep_devs(intf);
>         }
>
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 1da4ad161..0ec743e76 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -266,6 +266,8 @@ struct usb_interface {
>         unsigned needs_binding:1;       /* needs delayed unbind/rebind */
>         unsigned resetting_device:1;    /* true: bandwidth alloc after
> reset */
>         unsigned authorized:1;          /* used for interface
> authorization */
> +       unsigned claimed:1;             /* driver claimed before
> device_add() */
> +       struct usb_driver *claimed_driver;      /* driver for deferred
> bind */
>         enum usb_wireless_status wireless_status;
>         struct work_struct wireless_status_work;
> --
> 2.34.1
>
> On Thu, Sep 3, 2026 at 1:30 PM Akihiko Kai <khiemtranzo532001@gmail.com>
> wrote:
>
>> usb_driver_claim_interface() sets dev->driver unconditionally before
>> checking device_is_registered(dev).  When called from usb_audio_probe()
>> during configuration, the interface device has not been added to the
>> driver core yet (device_add() is called later in usb_set_configuration()).
>>
>> As a result, knode_driver is never attached to the driver's klist, but
>> dev->driver is set.  On subsequent disconnect, bus_remove_device() calls
>> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
>> unconditionally on the uninitialized node, causing a general protection
>> fault:
>>
>>   BUG: kernel NULL pointer dereference
>>   RIP: klist_remove+0x...
>>   Call Trace:
>>    __device_release_driver
>>    bus_remove_device
>>    device_del
>>    usb_disable_device
>>    usb_disconnect
>>
>> Fix this by deferring the assignment of dev->driver for interfaces that
>> are not yet registered.  Instead, record the claim via two new fields in
>> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
>> After device_add() completes in usb_set_configuration(), call
>> device_bind_driver() explicitly for claimed interfaces.
>>
>> device_bind_driver() skips ->probe() (which is exactly what usb_audio
>> needs — PCM and MIDI devices are created before bind), but it does
>> attach knode_driver to the driver's klist, making teardown safe.
>>
>> The else-if branch in dd.c that handles dev->driver already set at
>> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
>> others) is intentionally left untouched.
>>
>> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
>> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
>> ---
>>  drivers/usb/core/driver.c  | 19 ++++++++++++++-----
>>  drivers/usb/core/message.c | 15 +++++++++++++++
>>  include/linux/usb.h        |  2 ++
>>  3 files changed, 31 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
>> index f63004417..59e74872b 100644
>> --- a/drivers/usb/core/driver.c
>> +++ b/drivers/usb/core/driver.c
>> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>>         if (!iface->authorized)
>>                 return -ENODEV;
>>
>> -       dev->driver = &driver->driver;
>>         usb_set_intfdata(iface, data);
>>         iface->needs_binding = 0;
>>
>> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
>> *driver,
>>         else
>>                 pm_runtime_set_active(dev);
>>
>> -       /* if interface was already added, bind now; else let
>> -        * the future device_add() bind it, bypassing probe()
>> -        */
>> -       if (device_is_registered(dev))
>> +       if (device_is_registered(dev)) {
>> +               dev->driver = &driver->driver;
>>                 retval = device_bind_driver(dev);
>> +       } else {
>> +               /*
>> +                * Interface not yet registered: record the claim without
>> +                * setting dev->driver.  usb_set_configuration() will call
>> +                * device_bind_driver() explicitly after device_add(),
>> which
>> +                * skips ->probe() and attaches knode_driver so teardown
>> is safe.
>> +                */
>> +               iface->claimed = 1;
>> +               iface->claimed_driver = driver;
>> +       }
>>
>>         if (retval) {
>>                 dev->driver = NULL;
>> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
>> index 75e2bfd74..73c630750 100644
>> --- a/drivers/usb/core/message.c
>> +++ b/drivers/usb/core/message.c
>> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
>> int configuration)
>>                 if (ret != 0) {
>>                         dev_err(&dev->dev, "device_add(%s) --> %d\n",
>>                                 dev_name(&intf->dev), ret);
>> +                       intf->claimed = 0;
>> +                       intf->claimed_driver = NULL;
>>                         continue;
>>                 }
>> +               if (intf->claimed) {
>> +                       intf->dev.driver = &intf->claimed_driver->driver;
>> +                       ret = device_bind_driver(&intf->dev);
>> +                       if (ret) {
>> +                               dev_err(&dev->dev,
>> +                                       "device_bind_driver(%s) --> %d\n",
>> +                                       dev_name(&intf->dev), ret);
>> +                               intf->dev.driver = NULL;
>> +                               intf->condition = USB_INTERFACE_UNBOUND;
>> +                       }
>> +                       intf->claimed = 0;
>> +                       intf->claimed_driver = NULL;
>> +               }
>>                 create_intf_ep_devs(intf);
>>         }
>>
>> diff --git a/include/linux/usb.h b/include/linux/usb.h
>> index 1da4ad161..0ec743e76 100644
>> --- a/include/linux/usb.h
>> +++ b/include/linux/usb.h
>> @@ -266,6 +266,8 @@ struct usb_interface {
>>         unsigned needs_binding:1;       /* needs delayed unbind/rebind */
>>         unsigned resetting_device:1;    /* true: bandwidth alloc after
>> reset */
>>         unsigned authorized:1;          /* used for interface
>> authorization */
>> +       unsigned claimed:1;             /* driver claimed before
>> device_add() */
>> +       struct usb_driver *claimed_driver;      /* driver for deferred
>> bind */
>>         enum usb_wireless_status wireless_status;
>>         struct work_struct wireless_status_work;
>> --
>> 2.34.1
>>
>