Re: [PATCH v4] driver core: avoid klist_remove() on unattached knode_driver

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Aug 20, 2026 at 04:45:57PM +0800, Nguyen Quang Le Kien wrote:
> usb_driver_claim_interface() sets dev->driver directly and skips
> device_bind_driver() when the interface is not yet registered, so the
> device can reach teardown with dev->driver set but knode_driver never
> added to the driver's klist_devices. __device_release_driver() then
> unconditionally calls klist_remove() on the unattached node, which
> dereferences a NULL klist pointer in klist_put() and crashes.
> 
> Only remove the node if the device is actually bound. Use
> device_is_bound() rather than klist_node_attached() directly: the
> latter is a raw klist API and does not NULL-check dev->p, while
> device_is_bound() is the standard bound-state check used throughout
> driver core (driver_bound(), __device_attach()).
> 
> Fixes: 94e7b1c5ff20 ("[PATCH] Add a klist to struct device_driver for the devices bound to it.")
> Reported-by: syzbot+87188222c77c0dbbdb4d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Cc: stable@vger.kernel.org
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
> ---
> Changes in v4:
> - add a changelog below the --- line, as required by submitting-patches.rst
> - add Cc: stable@vger.kernel.org, Fixes: points to a released kernel

Please slow down.  As my bot said, there is no rush, no deadline, and
it's the middle of the merge window and we can't even do anything with
this anyway.

At the least, wait a week between patch revisions.  If you wish to see
patches reviewed faster, then help out with actual reviews of patches
from others.  Constantly resending stuff like this doesn't make anyone
want to review this at all.

thanks,

greg k-h