Re: [PATCH 14/14] xhci: Prevent invalid vdev dereference during sideband unregister

[sashiko-bot@kernel.org]

> Offloaded USB audio devices using the xhci-sideband API store a pointer to
> the xhci virtual device (vdev) in the sideband structure when registering.
> 
> This pointer typically remains valid throughout the lifetime of the USB
> device. If a configured offloaded device requires a reset, the USB core
> usually unbinds or notifies the audio driver beforehand, ensuring that the
> sideband is unregistered before the vdev is freed.
> 
> An exception occurs when the USB core resets a device to recover from a
> failed resume, but a subsequent 'address device' request also fails. To
> recover in this specific scenario, the xHCI driver disables and re-enables
> the slot, which frees and re-allocates the vdev.
> 
> xhci_sideband_unregister() later dereferences the stale, previously freed
> vdev pointer during disconnect, triggering a kernel oops:
> [ ... ]
> Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217000B59003EDF233D7246D2B22@TYUPR06MB6217.apcprd06.prod.outlook.com/
> Tested-by: Lianqin Hu <hulianqin@vivo.com>
> Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009095834.561578-1-mathias.nyman@linux.intel.com?part=14