[bug report] Potential order bug in 'drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c', primarily in 'skel_disconnect()'

[bug report] Potential order bug in 'drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c', primarily in 'skel_disconnect()'

[Ginger]

Dear Linux kernel maintainers,

My research-based static analyzer found a potential order bug within
the 'drivers/staging/gpib/lpvo_usb_gpib' subsystem, more specifically,
in 'drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c'.
This bug is similar to a previous bug report as discussed in
'https://lore.kernel.org/linux-usb/2026042718-unwieldy-dicing-626f@gregkh'.

Kernel version: long-term kernel v6.18.9

Potential concurrent triggering executions:
T0:
skel_disconnect
    --> usb_set_intfdata(interface, NULL);
    --> usb_deregister_dev(interface, &skel_class);
         --> usb_minors[intf->minor] = NULL;
T1:
usb_gpib_attach
   --> skel_do_open
       --> interface = usb_find_interface(&skel_driver, subminor);
       --> dev = usb_get_intfdata(interface);

In T0, the interface is nullified before its get deregistered. Thus,
it is possible for T1 to still get the usb dev and access it via the
interface, which, however, has been already nullified.

Thank you for your time and consideration.

Sincerely,
Ginger

Re: [bug report] Potential order bug in 'drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c', primarily in 'skel_disconnect()'

[Greg KH]

On Tue, Apr 28, 2026 at 01:07:36PM +0800, Ginger wrote:
> Dear Linux kernel maintainers,
> 
> My research-based static analyzer found a potential order bug within
> the 'drivers/staging/gpib/lpvo_usb_gpib' subsystem, more specifically,
> in 'drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c'.
> This bug is similar to a previous bug report as discussed in
> 'https://lore.kernel.org/linux-usb/2026042718-unwieldy-dicing-626f@gregkh'.
> 
> Kernel version: long-term kernel v6.18.9

Please do not run "static analyzer tools" on old kernel versions.
Please always do so on the latest kernel release (hint, this file is no
longer in this place anymore.)

thanks,

greg k-h