[PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure

[PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure

[Cen Zhang]

xusbatm_capture_intf() claims a sibling interface before changing it to
the requested alternate setting. usb_driver_claim_interface() binds the
sibling interface and stores the usbatm instance as its intfdata.

If usb_set_interface() fails after that claim, xusbatm_bind() returns an
error and usbatm_usb_probe() frees the usbatm instance without calling
the mini-driver unbind callback. The sibling interface is left bound with
stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
with a freed instance.

Release the just-claimed interface when usb_set_interface() fails. This
clears intfdata before dropping the claim, matching xusbatm's existing
release helper and leaving the caller's rollback to handle any previously
captured interface.

Validation reproduced this kernel report:
KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
Workqueue: usb_hub_wq hub_event
The buggy address is located 224 bytes inside of freed 2048-byte region
[ffff888114339000, ffff888114339800)
Read of size 8
Call trace:
  dump_stack_lvl+0x66/0xa0
  print_report+0xce/0x630
  __mutex_lock+0x12a/0x1980
  srso_alias_return_thunk+0x5/0xfbef5
  __virt_addr_valid+0x188/0x320
  kasan_report+0xe0/0x110
  usbatm_usb_disconnect+0x52/0x440
  __lock_acquire+0x466/0x2260
  rcu_is_watching+0x20/0x50
  rpm_resume+0x705/0xab0
  usb_unbind_interface+0xf3/0x400
  device_release_driver_internal+0x298/0x330
  kobject_put+0x47/0x2e0 (lib/kobject.c:730)
  bus_remove_device+0x1c6/0x2d0
  device_del+0x218/0x540
  kfree+0x2f9/0x530
  kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
  usb_disable_device+0x180/0x3b0
  usb_set_configuration+0xab/0xf20
  blocking_notifier_call_chain+0x5f/0x70
  notifier_call_chain+0x60/0x1e0
  usb_unbind_device+0x40/0xe0
  __device_attach_driver+0xf1/0x1a0
  bus_for_each_drv+0xf9/0x160
  trace_hardirqs_on+0x18/0x130
  _raw_spin_unlock_irqrestore+0x44/0x60
  __device_attach+0x133/0x2a0
  do_raw_spin_unlock+0x9a/0x100
  device_add+0x9b9/0xc10
  add_device_randomness+0xb7/0xf0
  usb_new_device+0x492/0x870
  hub_event+0x1b10/0x29c0
  lock_acquire+0x187/0x300
  process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
  lock_release+0xc8/0x290
  process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
  __list_add_valid_or_report+0x37/0xf0
  worker_thread+0x2d8/0x570
  kthread+0x1ad/0x1f0
  ret_from_fork+0x3c9/0x540
  __switch_to+0x2e9/0x730

Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
 drivers/usb/atm/xusbatm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 0befbf63d1cc..a9e67aa136f3 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
 static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
 static struct usb_driver xusbatm_usb_driver;
 
+static void xusbatm_release_intf(struct usb_device *usb_dev,
+				 struct usb_interface *intf, int claimed);
+
 static struct usb_interface *xusbatm_find_intf(struct usb_device *usb_dev, int altsetting, u8 ep)
 {
 	struct usb_host_interface *alt;
@@ -62,6 +65,7 @@ static int xusbatm_capture_intf(struct usbatm_data *usbatm, struct usb_device *u
 	ret = usb_set_interface(usb_dev, ifnum, altsetting);
 	if (ret) {
 		usb_err(usbatm, "%s: altsetting %2d for interface %2d failed (%d)!\n", __func__, altsetting, ifnum, ret);
+		xusbatm_release_intf(usb_dev, intf, claim);
 		return ret;
 	}
 	return 0;
-- 
2.43.0

Re: [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure

[Greg KH]

On Thu, Jun 18, 2026 at 06:36:50PM +0800, Cen Zhang wrote:
> xusbatm_capture_intf() claims a sibling interface before changing it to
> the requested alternate setting. usb_driver_claim_interface() binds the
> sibling interface and stores the usbatm instance as its intfdata.
> 
> If usb_set_interface() fails after that claim, xusbatm_bind() returns an
> error and usbatm_usb_probe() frees the usbatm instance without calling
> the mini-driver unbind callback. The sibling interface is left bound with
> stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
> with a freed instance.
> 
> Release the just-claimed interface when usb_set_interface() fails. This
> clears intfdata before dropping the claim, matching xusbatm's existing
> release helper and leaving the caller's rollback to handle any previously
> captured interface.
> 
> Validation reproduced this kernel report:
> KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
> Workqueue: usb_hub_wq hub_event
> The buggy address is located 224 bytes inside of freed 2048-byte region
> [ffff888114339000, ffff888114339800)
> Read of size 8
> Call trace:
>   dump_stack_lvl+0x66/0xa0
>   print_report+0xce/0x630
>   __mutex_lock+0x12a/0x1980
>   srso_alias_return_thunk+0x5/0xfbef5
>   __virt_addr_valid+0x188/0x320
>   kasan_report+0xe0/0x110
>   usbatm_usb_disconnect+0x52/0x440
>   __lock_acquire+0x466/0x2260
>   rcu_is_watching+0x20/0x50
>   rpm_resume+0x705/0xab0
>   usb_unbind_interface+0xf3/0x400
>   device_release_driver_internal+0x298/0x330
>   kobject_put+0x47/0x2e0 (lib/kobject.c:730)
>   bus_remove_device+0x1c6/0x2d0
>   device_del+0x218/0x540
>   kfree+0x2f9/0x530
>   kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
>   usb_disable_device+0x180/0x3b0
>   usb_set_configuration+0xab/0xf20
>   blocking_notifier_call_chain+0x5f/0x70
>   notifier_call_chain+0x60/0x1e0
>   usb_unbind_device+0x40/0xe0
>   __device_attach_driver+0xf1/0x1a0
>   bus_for_each_drv+0xf9/0x160
>   trace_hardirqs_on+0x18/0x130
>   _raw_spin_unlock_irqrestore+0x44/0x60
>   __device_attach+0x133/0x2a0
>   do_raw_spin_unlock+0x9a/0x100
>   device_add+0x9b9/0xc10
>   add_device_randomness+0xb7/0xf0
>   usb_new_device+0x492/0x870
>   hub_event+0x1b10/0x29c0
>   lock_acquire+0x187/0x300
>   process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
>   lock_release+0xc8/0x290
>   process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
>   __list_add_valid_or_report+0x37/0xf0
>   worker_thread+0x2d8/0x570
>   kthread+0x1ad/0x1f0
>   ret_from_fork+0x3c9/0x540
>   __switch_to+0x2e9/0x730
> 
> Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> ---
>  drivers/usb/atm/xusbatm.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
> index 0befbf63d1cc..a9e67aa136f3 100644
> --- a/drivers/usb/atm/xusbatm.c
> +++ b/drivers/usb/atm/xusbatm.c
> @@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
>  static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
>  static struct usb_driver xusbatm_usb_driver;
>  
> +static void xusbatm_release_intf(struct usb_device *usb_dev,
> +				 struct usb_interface *intf, int claimed);
> +

Why not move the function so you don't have this prototype needed?

thanks,

greg k-h