* [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure
@ 2026-06-18 10:36 Cen Zhang
2026-07-08 15:02 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Cen Zhang @ 2026-06-18 10:36 UTC (permalink / raw)
To: Duncan Sands; +Cc: linux-usb, baijiaju1990, zzzccc427
xusbatm_capture_intf() claims a sibling interface before changing it to
the requested alternate setting. usb_driver_claim_interface() binds the
sibling interface and stores the usbatm instance as its intfdata.
If usb_set_interface() fails after that claim, xusbatm_bind() returns an
error and usbatm_usb_probe() frees the usbatm instance without calling
the mini-driver unbind callback. The sibling interface is left bound with
stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
with a freed instance.
Release the just-claimed interface when usb_set_interface() fails. This
clears intfdata before dropping the claim, matching xusbatm's existing
release helper and leaving the caller's rollback to handle any previously
captured interface.
Validation reproduced this kernel report:
KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
Workqueue: usb_hub_wq hub_event
The buggy address is located 224 bytes inside of freed 2048-byte region
[ffff888114339000, ffff888114339800)
Read of size 8
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
__mutex_lock+0x12a/0x1980
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x188/0x320
kasan_report+0xe0/0x110
usbatm_usb_disconnect+0x52/0x440
__lock_acquire+0x466/0x2260
rcu_is_watching+0x20/0x50
rpm_resume+0x705/0xab0
usb_unbind_interface+0xf3/0x400
device_release_driver_internal+0x298/0x330
kobject_put+0x47/0x2e0 (lib/kobject.c:730)
bus_remove_device+0x1c6/0x2d0
device_del+0x218/0x540
kfree+0x2f9/0x530
kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
usb_disable_device+0x180/0x3b0
usb_set_configuration+0xab/0xf20
blocking_notifier_call_chain+0x5f/0x70
notifier_call_chain+0x60/0x1e0
usb_unbind_device+0x40/0xe0
__device_attach_driver+0xf1/0x1a0
bus_for_each_drv+0xf9/0x160
trace_hardirqs_on+0x18/0x130
_raw_spin_unlock_irqrestore+0x44/0x60
__device_attach+0x133/0x2a0
do_raw_spin_unlock+0x9a/0x100
device_add+0x9b9/0xc10
add_device_randomness+0xb7/0xf0
usb_new_device+0x492/0x870
hub_event+0x1b10/0x29c0
lock_acquire+0x187/0x300
process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
lock_release+0xc8/0x290
process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
__list_add_valid_or_report+0x37/0xf0
worker_thread+0x2d8/0x570
kthread+0x1ad/0x1f0
ret_from_fork+0x3c9/0x540
__switch_to+0x2e9/0x730
Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
drivers/usb/atm/xusbatm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 0befbf63d1cc..a9e67aa136f3 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
static struct usb_driver xusbatm_usb_driver;
+static void xusbatm_release_intf(struct usb_device *usb_dev,
+ struct usb_interface *intf, int claimed);
+
static struct usb_interface *xusbatm_find_intf(struct usb_device *usb_dev, int altsetting, u8 ep)
{
struct usb_host_interface *alt;
@@ -62,6 +65,7 @@ static int xusbatm_capture_intf(struct usbatm_data *usbatm, struct usb_device *u
ret = usb_set_interface(usb_dev, ifnum, altsetting);
if (ret) {
usb_err(usbatm, "%s: altsetting %2d for interface %2d failed (%d)!\n", __func__, altsetting, ifnum, ret);
+ xusbatm_release_intf(usb_dev, intf, claim);
return ret;
}
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure
2026-06-18 10:36 [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure Cen Zhang
@ 2026-07-08 15:02 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2026-07-08 15:02 UTC (permalink / raw)
To: Cen Zhang; +Cc: Duncan Sands, linux-usb, baijiaju1990
On Thu, Jun 18, 2026 at 06:36:50PM +0800, Cen Zhang wrote:
> xusbatm_capture_intf() claims a sibling interface before changing it to
> the requested alternate setting. usb_driver_claim_interface() binds the
> sibling interface and stores the usbatm instance as its intfdata.
>
> If usb_set_interface() fails after that claim, xusbatm_bind() returns an
> error and usbatm_usb_probe() frees the usbatm instance without calling
> the mini-driver unbind callback. The sibling interface is left bound with
> stale intfdata, so a later disconnect can call usbatm_usb_disconnect()
> with a freed instance.
>
> Release the just-claimed interface when usb_set_interface() fails. This
> clears intfdata before dropping the claim, matching xusbatm's existing
> release helper and leaving the caller's rollback to handle any previously
> captured interface.
>
> Validation reproduced this kernel report:
> KASAN slab-use-after-free in __mutex_lock+0x12a/0x1980
> Workqueue: usb_hub_wq hub_event
> The buggy address is located 224 bytes inside of freed 2048-byte region
> [ffff888114339000, ffff888114339800)
> Read of size 8
> Call trace:
> dump_stack_lvl+0x66/0xa0
> print_report+0xce/0x630
> __mutex_lock+0x12a/0x1980
> srso_alias_return_thunk+0x5/0xfbef5
> __virt_addr_valid+0x188/0x320
> kasan_report+0xe0/0x110
> usbatm_usb_disconnect+0x52/0x440
> __lock_acquire+0x466/0x2260
> rcu_is_watching+0x20/0x50
> rpm_resume+0x705/0xab0
> usb_unbind_interface+0xf3/0x400
> device_release_driver_internal+0x298/0x330
> kobject_put+0x47/0x2e0 (lib/kobject.c:730)
> bus_remove_device+0x1c6/0x2d0
> device_del+0x218/0x540
> kfree+0x2f9/0x530
> kobject_put+0xf4/0x2e0 (lib/kobject.c:730)
> usb_disable_device+0x180/0x3b0
> usb_set_configuration+0xab/0xf20
> blocking_notifier_call_chain+0x5f/0x70
> notifier_call_chain+0x60/0x1e0
> usb_unbind_device+0x40/0xe0
> __device_attach_driver+0xf1/0x1a0
> bus_for_each_drv+0xf9/0x160
> trace_hardirqs_on+0x18/0x130
> _raw_spin_unlock_irqrestore+0x44/0x60
> __device_attach+0x133/0x2a0
> do_raw_spin_unlock+0x9a/0x100
> device_add+0x9b9/0xc10
> add_device_randomness+0xb7/0xf0
> usb_new_device+0x492/0x870
> hub_event+0x1b10/0x29c0
> lock_acquire+0x187/0x300
> process_one_work+0x475/0xb90 (kernel/workqueue.c:3200)
> lock_release+0xc8/0x290
> process_one_work+0x4d7/0xb90 (kernel/workqueue.c:3200)
> __list_add_valid_or_report+0x37/0xf0
> worker_thread+0x2d8/0x570
> kthread+0x1ad/0x1f0
> ret_from_fork+0x3c9/0x540
> __switch_to+0x2e9/0x730
>
> Fixes: 233c08e0ff30 ("[PATCH] USBATM: xusbatm rewrite")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> ---
> drivers/usb/atm/xusbatm.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
> index 0befbf63d1cc..a9e67aa136f3 100644
> --- a/drivers/usb/atm/xusbatm.c
> +++ b/drivers/usb/atm/xusbatm.c
> @@ -35,6 +35,9 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
> static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
> static struct usb_driver xusbatm_usb_driver;
>
> +static void xusbatm_release_intf(struct usb_device *usb_dev,
> + struct usb_interface *intf, int claimed);
> +
Why not move the function so you don't have this prototype needed?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-08 15:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-18 10:36 [PATCH] usb: atm: xusbatm: release claimed interface on set-interface failure Cen Zhang
2026-07-08 15:02 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox