[PATCH] usb: usbtest: fix NULL pointer dereference in usbtest_probe

[PATCH] usb: usbtest: fix NULL pointer dereference in usbtest_probe

[syzbot]

From: Aleksandr Nogikh <nogikh@google.com>

The usbtest driver relies on the driver_info field of the usb_device_id
structure to hold a pointer to a struct usbtest_info, which contains
necessary configuration for the device. When a new device ID is dynamically
added via the sysfs new_id interface without specifying a reference device,
the driver_info field defaults to 0. When the USB core binds the device
using this dynamic ID, usbtest_probe() unconditionally casts the 0 to a
pointer, resulting in a NULL pointer dereference when attempting to access
the autoconf bitfield (at offset 0xa) of the struct usbtest_info.

This leads to the following crash:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:usbtest_probe+0x522/0xcc0 drivers/usb/misc/usbtest.c:2822
Call Trace:
 <TASK>
 usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
 __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
 bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
 device_add+0x7d7/0xb80 drivers/base/core.c:3772
 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291

To fix this, validate that id->driver_info is not NULL before proceeding
with the probe. If it is NULL, gracefully return -ENODEV. The check is
placed before any memory allocation to avoid unnecessary work and simplify
error handling.

Fixes: 733260ff9c45 ("[PATCH] USB: add dynamic id functionality to USB core")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
Link: https://syzkaller.appspot.com/ai_job?id=9e476ca5-99d1-47d2-b9d1-f3b501897179
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>

---
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 98071b25a..6410b3e26 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -2786,10 +2786,13 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	}
 #endif
 
+	info = (struct usbtest_info *) id->driver_info;
+	if (!info)
+		return -ENODEV;
+
 	dev = kzalloc_obj(*dev);
 	if (!dev)
 		return -ENOMEM;
-	info = (struct usbtest_info *) id->driver_info;
 	dev->info = info;
 	mutex_init(&dev->lock);
 


base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH] usb: usbtest: fix NULL pointer dereference in usbtest_probe

[Greg Kroah-Hartman]

On Wed, Jul 29, 2026 at 09:19:54AM +0000, syzbot wrote:
> From: Aleksandr Nogikh <nogikh@google.com>
> 
> The usbtest driver relies on the driver_info field of the usb_device_id
> structure to hold a pointer to a struct usbtest_info, which contains
> necessary configuration for the device. When a new device ID is dynamically
> added via the sysfs new_id interface without specifying a reference device,
> the driver_info field defaults to 0. When the USB core binds the device
> using this dynamic ID, usbtest_probe() unconditionally casts the 0 to a
> pointer, resulting in a NULL pointer dereference when attempting to access
> the autoconf bitfield (at offset 0xa) of the struct usbtest_info.
> 
> This leads to the following crash:
> 
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> RIP: 0010:usbtest_probe+0x522/0xcc0 drivers/usb/misc/usbtest.c:2822
> Call Trace:
>  <TASK>
>  usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
>  call_driver_probe drivers/base/dd.c:-1 [inline]
>  really_probe+0x254/0xae0 drivers/base/dd.c:706
>  __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
>  driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
>  __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
>  bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
>  __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
>  device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
>  bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
>  device_add+0x7d7/0xb80 drivers/base/core.c:3772
>  usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
>  usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
>  usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
> 
> To fix this, validate that id->driver_info is not NULL before proceeding
> with the probe. If it is NULL, gracefully return -ENODEV. The check is
> placed before any memory allocation to avoid unnecessary work and simplify
> error handling.
> 
> Fixes: 733260ff9c45 ("[PATCH] USB: add dynamic id functionality to USB core")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> Link: https://syzkaller.appspot.com/ai_job?id=9e476ca5-99d1-47d2-b9d1-f3b501897179
> Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
> 
> ---
> diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> index 98071b25a..6410b3e26 100644
> --- a/drivers/usb/misc/usbtest.c
> +++ b/drivers/usb/misc/usbtest.c
> @@ -2786,10 +2786,13 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
>  	}
>  #endif
>  
> +	info = (struct usbtest_info *) id->driver_info;

Extra space there, right?  Didn't checkpatch catch that?

And this really isn't the proper solution, just don't allow dynamic
binding for this driver.  That should resolve it, right?

thanks,

greg k-h

Re: [PATCH] usb: usbtest: fix NULL pointer dereference in usbtest_probe

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 05:13:00PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Jul 29, 2026 at 09:19:54AM +0000, syzbot wrote:
> > From: Aleksandr Nogikh <nogikh@google.com>
> > 
> > The usbtest driver relies on the driver_info field of the usb_device_id
> > structure to hold a pointer to a struct usbtest_info, which contains
> > necessary configuration for the device. When a new device ID is dynamically
> > added via the sysfs new_id interface without specifying a reference device,
> > the driver_info field defaults to 0. When the USB core binds the device
> > using this dynamic ID, usbtest_probe() unconditionally casts the 0 to a
> > pointer, resulting in a NULL pointer dereference when attempting to access
> > the autoconf bitfield (at offset 0xa) of the struct usbtest_info.
> > 
> > This leads to the following crash:
> > 
> > Oops: general protection fault, probably for non-canonical address
> > 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > RIP: 0010:usbtest_probe+0x522/0xcc0 drivers/usb/misc/usbtest.c:2822
> > Call Trace:
> >  <TASK>
> >  usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
> >  call_driver_probe drivers/base/dd.c:-1 [inline]
> >  really_probe+0x254/0xae0 drivers/base/dd.c:706
> >  __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
> >  driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
> >  __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
> >  bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
> >  __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
> >  device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
> >  bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
> >  device_add+0x7d7/0xb80 drivers/base/core.c:3772
> >  usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
> >  usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
> >  usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
> > 
> > To fix this, validate that id->driver_info is not NULL before proceeding
> > with the probe. If it is NULL, gracefully return -ENODEV. The check is
> > placed before any memory allocation to avoid unnecessary work and simplify
> > error handling.
> > 
> > Fixes: 733260ff9c45 ("[PATCH] USB: add dynamic id functionality to USB core")

Not really, but I can see why the LLM thinks this.  It's "just how this
driver works" instead, right?

> > Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> > Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> > Link: https://syzkaller.appspot.com/ai_job?id=9e476ca5-99d1-47d2-b9d1-f3b501897179
> > Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
> > 
> > ---
> > diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> > index 98071b25a..6410b3e26 100644
> > --- a/drivers/usb/misc/usbtest.c
> > +++ b/drivers/usb/misc/usbtest.c
> > @@ -2786,10 +2786,13 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
> >  	}
> >  #endif
> >  
> > +	info = (struct usbtest_info *) id->driver_info;
> 
> Extra space there, right?  Didn't checkpatch catch that?
> 
> And this really isn't the proper solution, just don't allow dynamic
> binding for this driver.  That should resolve it, right?

If you don't want to do that, you need a BIG comment here as to what you
are trying to prevent, as a NULL check just looks like any other normal
check, while you are trying to prevent a specific use case from being
possible, and it WILL have user-visable affect.

thanks,

greg k-h

Re: [PATCH] usb: usbtest: fix NULL pointer dereference in usbtest_probe

[Aleksandr Nogikh]

Hi Greg,

Thanks for the review!


On Mon, Aug 3, 2026 at 5:15 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Aug 03, 2026 at 05:13:00PM +0200, Greg Kroah-Hartman wrote:
> > On Wed, Jul 29, 2026 at 09:19:54AM +0000, syzbot wrote:
> > > From: Aleksandr Nogikh <nogikh@google.com>
> > >
> > > The usbtest driver relies on the driver_info field of the usb_device_id
> > > structure to hold a pointer to a struct usbtest_info, which contains
> > > necessary configuration for the device. When a new device ID is dynamically
> > > added via the sysfs new_id interface without specifying a reference device,
> > > the driver_info field defaults to 0. When the USB core binds the device
> > > using this dynamic ID, usbtest_probe() unconditionally casts the 0 to a
> > > pointer, resulting in a NULL pointer dereference when attempting to access
> > > the autoconf bitfield (at offset 0xa) of the struct usbtest_info.
> > >
> > > This leads to the following crash:
> > >
> > > Oops: general protection fault, probably for non-canonical address
> > > 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> > > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > > RIP: 0010:usbtest_probe+0x522/0xcc0 drivers/usb/misc/usbtest.c:2822
> > > Call Trace:
> > >  <TASK>
> > >  usb_probe_interface+0x653/0xc60 drivers/usb/core/driver.c:396
> > >  call_driver_probe drivers/base/dd.c:-1 [inline]
> > >  really_probe+0x254/0xae0 drivers/base/dd.c:706
> > >  __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
> > >  driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
> > >  __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
> > >  bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500
> > >  __device_attach+0x2c4/0x450 drivers/base/dd.c:1098
> > >  device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
> > >  bus_probe_device+0x12a/0x220 drivers/base/bus.c:620
> > >  device_add+0x7d7/0xb80 drivers/base/core.c:3772
> > >  usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
> > >  usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
> > >  usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:291
> > >
> > > To fix this, validate that id->driver_info is not NULL before proceeding
> > > with the probe. If it is NULL, gracefully return -ENODEV. The check is
> > > placed before any memory allocation to avoid unnecessary work and simplify
> > > error handling.
> > >
> > > Fixes: 733260ff9c45 ("[PATCH] USB: add dynamic id functionality to USB core")
>
> Not really, but I can see why the LLM thinks this.  It's "just how this
> driver works" instead, right?
>
> > > Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> > > Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> > > Link: https://syzkaller.appspot.com/ai_job?id=9e476ca5-99d1-47d2-b9d1-f3b501897179
> > > Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
> > >
> > > ---
> > > diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> > > index 98071b25a..6410b3e26 100644
> > > --- a/drivers/usb/misc/usbtest.c
> > > +++ b/drivers/usb/misc/usbtest.c
> > > @@ -2786,10 +2786,13 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
> > >     }
> > >  #endif
> > >
> > > +   info = (struct usbtest_info *) id->driver_info;
> >
> > Extra space there, right?  Didn't checkpatch catch that?

The checkpatch was happy with the diff:
total: 0 errors, 0 warnings, 14 lines checked

You mean the whitespace after `*)`?
I've just looked at the other code in `drivers/usb/misc/usbtest.c`,
and it's inconsistent: in some cases there's a whiltespace, in some
isn't.

> >
> > And this really isn't the proper solution, just don't allow dynamic
> > binding for this driver.  That should resolve it, right?

I'll double-check that and send a v2, thanks for the suggestion.

>
> If you don't want to do that, you need a BIG comment here as to what you
> are trying to prevent, as a NULL check just looks like any other normal
> check, while you are trying to prevent a specific use case from being
> possible, and it WILL have user-visable affect.
>
> thanks,
>
> greg k-h

-- 
Aleksandr

[PATCH v2] usb: usbtest: disable dynamic ID support

[Aleksandr Nogikh]

The usbtest driver relies on the driver_info field of struct usb_device_id
to point to a valid struct usbtest_info descriptor. This structure contains
essential test configurations, such as endpoint addresses and test modes,
which are required during probe.

When a user dynamically adds a new device ID via the sysfs new_id
interface without specifying a reference device, the USB core initializes
driver_info to 0 (NULL). When a matching device is subsequently probed,
usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
pointer and dereferences it, leading to a NULL pointer dereference crash:

  Oops: general protection fault, probably for non-canonical address
  0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822

Because usbtest strictly requires pre-defined usbtest_info descriptors
to function, dynamic ID binding via sysfs is fundamentally unsupported
for this driver.

Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
the USB core to skip creating the new_id and remove_id sysfs interfaces
for usbtest, preventing invalid dynamic ID entries from being created.

Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
---
Changes in v2:
- Disable dynamic IDs via .no_dynamic_id = 1 instead of adding a runtime NULL
  check in probe().
- Link to v1: https://lore.kernel.org/r/2650cf0f-26f9-48b5-b198-e4cb67c59cf0@mail.kernel.org

 drivers/usb/misc/usbtest.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 98071b25ac076..8759df49be287 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -3054,6 +3054,7 @@ static struct usb_driver usbtest_driver = {
 	.disconnect =	usbtest_disconnect,
 	.suspend =	usbtest_suspend,
 	.resume =	usbtest_resume,
+	.no_dynamic_id = 1,
 };
 
 /*-------------------------------------------------------------------------*/
-- 
base-commit: 48a5a7ab8d6ab7090564339e039c421f315de912
-- 
2.55.0.654.g21b8a5bc05-goog

Re: [PATCH v2] usb: usbtest: disable dynamic ID support

[Greg Kroah-Hartman]

On Thu, Aug 06, 2026 at 02:25:11PM +0000, Aleksandr Nogikh wrote:
> The usbtest driver relies on the driver_info field of struct usb_device_id
> to point to a valid struct usbtest_info descriptor. This structure contains
> essential test configurations, such as endpoint addresses and test modes,
> which are required during probe.
> 
> When a user dynamically adds a new device ID via the sysfs new_id
> interface without specifying a reference device, the USB core initializes
> driver_info to 0 (NULL). When a matching device is subsequently probed,
> usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
> pointer and dereferences it, leading to a NULL pointer dereference crash:
> 
>   Oops: general protection fault, probably for non-canonical address
>   0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
>   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
>   RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822
> 
> Because usbtest strictly requires pre-defined usbtest_info descriptors
> to function, dynamic ID binding via sysfs is fundamentally unsupported
> for this driver.
> 
> Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
> the USB core to skip creating the new_id and remove_id sysfs interfaces
> for usbtest, preventing invalid dynamic ID entries from being created.
> 
> Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> Signed-off-by: Aleksandr Nogikh <nogikh@google.com>

Shouldn't this also get a cc: stable?

thanks,

greg k-h

Re: [PATCH v2] usb: usbtest: disable dynamic ID support

[Aleksandr Nogikh]

On Thu, Aug 6, 2026 at 4:32 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Aug 06, 2026 at 02:25:11PM +0000, Aleksandr Nogikh wrote:
> > The usbtest driver relies on the driver_info field of struct usb_device_id
> > to point to a valid struct usbtest_info descriptor. This structure contains
> > essential test configurations, such as endpoint addresses and test modes,
> > which are required during probe.
> >
> > When a user dynamically adds a new device ID via the sysfs new_id
> > interface without specifying a reference device, the USB core initializes
> > driver_info to 0 (NULL). When a matching device is subsequently probed,
> > usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
> > pointer and dereferences it, leading to a NULL pointer dereference crash:
> >
> >   Oops: general protection fault, probably for non-canonical address
> >   0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> >   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> >   RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822
> >
> > Because usbtest strictly requires pre-defined usbtest_info descriptors
> > to function, dynamic ID binding via sysfs is fundamentally unsupported
> > for this driver.
> >
> > Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
> > the USB core to skip creating the new_id and remove_id sysfs interfaces
> > for usbtest, preventing invalid dynamic ID entries from being created.
> >
> > Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> > Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
>
> Shouldn't this also get a cc: stable?

Is there (in general) value in cc: stable without a Fixes: tag?

>
> thanks,
>
> greg k-h

Re: [PATCH v2] usb: usbtest: disable dynamic ID support

[Greg Kroah-Hartman]

On Thu, Aug 06, 2026 at 04:35:12PM +0200, Aleksandr Nogikh wrote:
> On Thu, Aug 6, 2026 at 4:32 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Thu, Aug 06, 2026 at 02:25:11PM +0000, Aleksandr Nogikh wrote:
> > > The usbtest driver relies on the driver_info field of struct usb_device_id
> > > to point to a valid struct usbtest_info descriptor. This structure contains
> > > essential test configurations, such as endpoint addresses and test modes,
> > > which are required during probe.
> > >
> > > When a user dynamically adds a new device ID via the sysfs new_id
> > > interface without specifying a reference device, the USB core initializes
> > > driver_info to 0 (NULL). When a matching device is subsequently probed,
> > > usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
> > > pointer and dereferences it, leading to a NULL pointer dereference crash:
> > >
> > >   Oops: general protection fault, probably for non-canonical address
> > >   0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> > >   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > >   RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822
> > >
> > > Because usbtest strictly requires pre-defined usbtest_info descriptors
> > > to function, dynamic ID binding via sysfs is fundamentally unsupported
> > > for this driver.
> > >
> > > Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
> > > the USB core to skip creating the new_id and remove_id sysfs interfaces
> > > for usbtest, preventing invalid dynamic ID entries from being created.
> > >
> > > Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> > > Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
> >
> > Shouldn't this also get a cc: stable?
> 
> Is there (in general) value in cc: stable without a Fixes: tag?

Very much so.  Don't you want this in stable trees so that your syzbot
runs on the older kernels don't fail horribly?  If not, then hey,
waiting for newer releases is fine with me, but I got the impression
this was a good thing to fix :)

thanks,

greg k-h

Re: [PATCH v2] usb: usbtest: disable dynamic ID support

[Aleksandr Nogikh]

On Thu, Aug 6, 2026 at 4:43 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Aug 06, 2026 at 04:35:12PM +0200, Aleksandr Nogikh wrote:
> > On Thu, Aug 6, 2026 at 4:32 PM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Thu, Aug 06, 2026 at 02:25:11PM +0000, Aleksandr Nogikh wrote:
> > > > The usbtest driver relies on the driver_info field of struct usb_device_id
> > > > to point to a valid struct usbtest_info descriptor. This structure contains
> > > > essential test configurations, such as endpoint addresses and test modes,
> > > > which are required during probe.
> > > >
> > > > When a user dynamically adds a new device ID via the sysfs new_id
> > > > interface without specifying a reference device, the USB core initializes
> > > > driver_info to 0 (NULL). When a matching device is subsequently probed,
> > > > usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
> > > > pointer and dereferences it, leading to a NULL pointer dereference crash:
> > > >
> > > >   Oops: general protection fault, probably for non-canonical address
> > > >   0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
> > > >   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > > >   RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822
> > > >
> > > > Because usbtest strictly requires pre-defined usbtest_info descriptors
> > > > to function, dynamic ID binding via sysfs is fundamentally unsupported
> > > > for this driver.
> > > >
> > > > Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
> > > > the USB core to skip creating the new_id and remove_id sysfs interfaces
> > > > for usbtest, preventing invalid dynamic ID entries from being created.
> > > >
> > > > Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
> > > > Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
> > > > Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
> > >
> > > Shouldn't this also get a cc: stable?
> >
> > Is there (in general) value in cc: stable without a Fixes: tag?
>
> Very much so.  Don't you want this in stable trees so that your syzbot
> runs on the older kernels don't fail horribly?  If not, then hey,
> waiting for newer releases is fine with me, but I got the impression
> this was a good thing to fix :)

I see, thanks for the clarification!
I've sent a v3 that Cc's stable.

>
> thanks,
>
> greg k-h

[PATCH v3] usb: usbtest: disable dynamic ID support

[Aleksandr Nogikh]

The usbtest driver relies on the driver_info field of struct usb_device_id
to point to a valid struct usbtest_info descriptor. This structure contains
essential test configurations, such as endpoint addresses and test modes,
which are required during probe.

When a user dynamically adds a new device ID via the sysfs new_id
interface without specifying a reference device, the USB core initializes
driver_info to 0 (NULL). When a matching device is subsequently probed,
usbtest_probe() unconditionally casts driver_info to a struct usbtest_info
pointer and dereferences it, leading to a NULL pointer dereference crash:

  Oops: general protection fault, probably for non-canonical address
  0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  RIP: 0010:usbtest_probe+0x3b9/0x1280 drivers/usb/misc/usbtest.c:2822

Because usbtest strictly requires pre-defined usbtest_info descriptors
to function, dynamic ID binding via sysfs is fundamentally unsupported
for this driver.

Fix this by setting .no_dynamic_id = 1 on usbtest_driver. This instructs
the USB core to skip creating the new_id and remove_id sysfs interfaces
for usbtest, preventing invalid dynamic ID entries from being created.

Cc: stable@vger.kernel.org
Reported-by: syzbot+7e1e5911f9eac50bedc7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7e1e5911f9eac50bedc7
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
---
Changes in v3:
- Cc stable.
- Link to v2: https://lore.kernel.org/r/20260806142511.2337081-1-nogikh@google.com

Changes in v2:
- Disable dynamic IDs via .no_dynamic_id = 1 instead of adding a runtime NULL
  check in probe().
- Link to v1: https://lore.kernel.org/r/2650cf0f-26f9-48b5-b198-e4cb67c59cf0@mail.kernel.org

 drivers/usb/misc/usbtest.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 98071b25ac076..8759df49be287 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -3054,6 +3054,7 @@ static struct usb_driver usbtest_driver = {
 	.disconnect =	usbtest_disconnect,
 	.suspend =	usbtest_suspend,
 	.resume =	usbtest_resume,
+	.no_dynamic_id = 1,
 };
 
 /*-------------------------------------------------------------------------*/
-- 
base-commit: 48a5a7ab8d6ab7090564339e039c421f315de912
-- 
2.55.0.654.g21b8a5bc05-goog