Re: [PATCH v2 1/3] driver core: fix parent lock use-after-free on USB disconnect

[sashiko-bot@kernel.org]

> USB interfaces should be probed with their parent USB device lock held
> and the USB bus therefore sets the need_parent_lock bus flag so that
> driver core takes the parent lock when needed.
> 
> Driver core is only guaranteed to hold a reference to the parent device
> during initial probe however and nothing prevents the device and its
> parent from being deregistered and the parent potentially freed, for
> example, while iterating over devices in driver_attach() or
> bus_rescan_devices_helper().
> 
> Since commit 524134d42231 ("USB: don't cancel queued resets when
> unbinding drivers") USB interfaces hold a reference to their parent USB
> device, but a parent hub may still go away while probing a USB device
> (e.g. via the drivers_probe sysfs interface). This can lead to a
> use-after-free when taking the parent device lock before checking the
> [ ... ]
> Fixes: bf74ad5bc417 ("[PATCH] Hold the device's parent's lock during probe and remove")
> Cc: stable@vger.kernel.org	# 2.6.16: 524134d42231: USB: don't cancel queued resets when unbinding drivers
> Cc: stable@vger.kernel.org	# 2.6.16
> Cc: Alan Stern <stern@rowland.harvard.edu>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014133109.1392265-1-johan@kernel.org?part=1