Re: [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure

[Greg KH <greg@kroah.com>]

On Thu, Jun 18, 2026 at 06:36:50PM +0800, Cen Zhang wrote:
> xusbatm_capture_intf() claims a sibling interface before changing it to
> the requested alternate setting. usb_driver_claim_interface() binds the
> sibling interface and stores the usbatm instance as its intfdata.
> 
> If usb_set_interface() fails after that claim, xusbatm_bind() returns an
> error and usbatm_usb_probe() frees the usbatm instance without calling
> the mini-driver unbind callback. The sibling interface is left bound with
> stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
> with a freed instance.
> 
> Release the just-claimed interface when usb_set_interface() fails. This
> clears intfdata before dropping the claim, matching xusbatm's existing
> release helper and leaving the caller's rollback to handle any previously
> captured interface.
> 
> Validation reproduced this kernel report:
> KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
> Workqueue: usb_hub_wq hub_event
> The buggy address is located 224 bytes inside of freed 2048-byte region
> [ffff888114339000, ffff888114339800)
> Read of size 8
> Call trace:
>   dump_stack_lvl+0x66/0xa0
>   print_report+0xce/0x630
>   __mutex_lock+0x12a/0x1980
>   srso_alias_return_thunk+0x5/0xfbef5
>   __virt_addr_valid+0x188/0x320
>   kasan_report+0xe0/0x110
>   usbatm_usb_disconnect+0x52/0x440
>   __lock_acquire+0x466/0x2260
>   rcu_is_watching+0x20/0x50
>   rpm_resume+0x705/0xab0
>   usb_unbind_interface+0xf3/0x400
>   device_release_driver_internal+0x298/0x330
>   kobject_put+0x47/0x2e0 (lib/kobject.c:730)
>   bus_remove_device+0x1c6/0x2d0
>   device_del+0x218/0x540
>   kfree+0x2f9/0x530
>   kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
>   usb_disable_device+0x180/0x3b0
>   usb_set_configuration+0xab/0xf20
>   blocking_notifier_call_chain+0x5f/0x70
>   notifier_call_chain+0x60/0x1e0
>   usb_unbind_device+0x40/0xe0
>   __device_attach_driver+0xf1/0x1a0
>   bus_for_each_drv+0xf9/0x160
>   trace_hardirqs_on+0x18/0x130
>   _raw_spin_unlock_irqrestore+0x44/0x60
>   __device_attach+0x133/0x2a0
>   do_raw_spin_unlock+0x9a/0x100
>   device_add+0x9b9/0xc10
>   add_device_randomness+0xb7/0xf0
>   usb_new_device+0x492/0x870
>   hub_event+0x1b10/0x29c0
>   lock_acquire+0x187/0x300
>   process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
>   lock_release+0xc8/0x290
>   process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
>   __list_add_valid_or_report+0x37/0xf0
>   worker_thread+0x2d8/0x570
>   kthread+0x1ad/0x1f0
>   ret_from_fork+0x3c9/0x540
>   __switch_to+0x2e9/0x730
> 
> Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> ---
>  drivers/usb/atm/xusbatm.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
> index 0befbf63d1cc..a9e67aa136f3 100644
> --- a/drivers/usb/atm/xusbatm.c
> +++ b/drivers/usb/atm/xusbatm.c
> @@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
>  static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
>  static struct usb_driver xusbatm_usb_driver;
>  
> +static void xusbatm_release_intf(struct usb_device *usb_dev,
> +				 struct usb_interface *intf, int claimed);
> +

Why not move the function so you don't have this prototype needed?

thanks,

greg k-h