Re: [PATCH] usbip: usbip_host: Fix null pointer dereference in rebind_store

[Jeffin Philip <jeffinphilip14@gmail.com>]

On Thu, Aug 06, 2026 at 07:42:27 +0200, Greg KH wrote:
>On Thu, Aug 06, 2026 at 11:06:51AM +0530, Jeffin Philip wrote:
>> On Thu, Aug 06 2026, Greg KH wrote:
>> >What prevents bid->udev from becoming NULL right after you checked this?
>> We could use usb_get_dev() and hold a reference to udev when the busid_lock
>> is being held and then release it after do_rebind, or would that be incorrect?
>
>I do not know, try it and see!

I tested usb_get_dev() and usb_put_dev() on the rebind path and it compiled
without errors. No undesired behavior during rebind either.

>> >How was this tested?
>> The method to reproduce it is in the same thread.
>
>How is this just now an issue?  What changed to cause it to suddenly
>start happening, or has this codepath never been tested?

Nothing has changed AFAIK. The driver itself depended on sequential
order of operations and in doing so, failed to secure itself against
non-sequential order of operations.

I will send patch v2 soon addressing these issues.

Thanks,
Jeffin.