From: "Danilo Krummrich" <dakr@kernel.org>
To: "Akihiko Kai" <khiemtranzo532001@gmail.com>
Cc: "Alan Stern" <stern@rowland.harvard.edu>,
<gregkh@linuxfoundation.org>, <rafael@kernel.org>,
<driver-core@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
<syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com>,
<stable@vger.kernel.org>, <linux-usb@vger.kernel.org>
Subject: Re: [PATCH v4] driver core: avoid klist_remove() on unattached knode_driver
Date: Wed, 26 Aug 2026 23:14:41 +0200 [thread overview]
Message-ID: <DKZ6PZV65PYX.3M9UEZC4ZMLLC@kernel.org> (raw)
In-Reply-To: <CAEe5be5OjseCMxGQP=QMd1L-muOTDguaay_-21moS1+xRNNNyw@mail.gmail.com>
On Mon Aug 24, 2026 at 6:47 AM CEST, Akihiko Kai wrote:
> On Fri, Aug 21, 2026 at 03:54:44AM +0200, Danilo Krummrich wrote:
>> usb_driver_claim_interface() is the only callsite in the kernel that
>> does set dev->driver without a subsequent device_bind_driver().
>
> Small correction, I think there are a few more. usb_port
> (drivers/usb/core/port.c:782) sets dev->driver before device_register(),
> and usb_port_driver has no ->match and no ->probe, so it depends entirely
> on the __device_attach() dev->driver path to get bound. ccwgroup
> (drivers/s390/cio/ccwgroup.c:385) and pata_parport
> (drivers/ata/pata_parport/pata_parport.c:515) do the same. So that path
> doesn't look USB-claim-specific, and if we ever want to remove it,
> usb_port would need a ->match() first.
Good catch, I think those should be fixed as well.
I had a brief look at the usb_port one and it should be exactly the same case as
w1, which I already fixed [1]. Actually, it is even simpler, usb_device_match()
can just handle the usb_port_device_type, as the USB core already does for other
device types. I can send a patch for this later on.
[1] https://lore.kernel.org/driver-core/20260820225430.1847356-1-dakr@kernel.org/
> For the root cause, what about this: in usb_driver_claim_interface(),
> when the interface isn't registered yet, just don't set dev->driver --
> record the claim on struct usb_interface instead. Then, once the
> interface gets added in usb_set_configuration(), bind it explicitly with
> device_bind_driver(). That skips ->probe, which is exactly what
> usb_audio's claim-now-bind-later needs, and it also attaches
> knode_driver so teardown is safe. The __device_attach() path can stay
> for w1/ccwgroup/pata_parport.
>
> Does that sound reasonable?
I'd prefer to get rid of the dev->driver path in __device_attach(), I think
there's no reason not to use the common match() path instead.
So, for a fix that also goes into stable trees what you propose sounds
reasonable, but eventually we should use the match() infrastructure instead.
next prev parent reply other threads:[~2026-08-26 21:14 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-20 5:55 [PATCH] driver core: avoid klist_remove() on unattached knode_driver Nguyen Quang Le Kien
2026-08-20 6:05 ` [PATCH v2] " Nguyen Quang Le Kien
2026-08-20 6:40 ` Greg KH
2026-08-20 6:56 ` Nguyen Quang Le Kien
2026-08-20 7:05 ` Greg Kroah-Hartman
2026-08-20 7:45 ` [PATCH v3] " Nguyen Quang Le Kien
2026-08-20 8:23 ` Greg Kroah-Hartman
2026-08-20 8:45 ` [PATCH v4] " Nguyen Quang Le Kien
2026-08-20 8:56 ` Greg KH
2026-08-20 16:14 ` Danilo Krummrich
2026-08-20 17:22 ` Alan Stern
2026-08-20 20:54 ` Danilo Krummrich
[not found] ` <CAEe5be5OjseCMxGQP=QMd1L-muOTDguaay_-21moS1+xRNNNyw@mail.gmail.com>
2026-08-26 21:14 ` Danilo Krummrich [this message]
2026-09-03 8:05 ` Nguyen Quang Le Kien
-- strict thread matches above, loose matches on Subject: below --
2026-08-24 4:41 Nguyen Quang Le Kien
2026-08-24 4:46 Nguyen Quang Le Kien
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DKZ6PZV65PYX.3M9UEZC4ZMLLC@kernel.org \
--to=dakr@kernel.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=khiemtranzo532001@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.