[PATCH] USB: core: don't release an unbound claimed interface via the driver core

[Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>]

usb_driver_claim_interface() sets dev->driver on an interface and only
calls device_bind_driver() if the interface is already registered.
Otherwise the later device_add() is expected to bind it, but with
bus drivers_autoprobe disabled bus_probe_device() skips the attach, so
the interface ends up with dev->driver set while it was never added to
the driver's klist.

usb_driver_release_interface() then sees a registered device and calls
device_release_driver(), which does klist_remove() on a node that is
not attached and dereferences a NULL klist:

  KASAN: null-ptr-deref in range [0x58-0x5f]
  RIP: klist_put+0x4d/0x1d0
   klist_remove+0x14c/0x2e0
   device_release_driver_internal+0x4fb/0x620
   usb_driver_release_interface+0x10e/0x190
   cdc_ncm_unbind+0x2ac/0x350
   usbnet_disconnect+0x1e2/0x300
   usb_unbind_interface+0x1dd/0x9e0

Decide on device_is_bound() instead of device_is_registered(): only go
through the driver core if it really bound the interface, otherwise use
the same direct unbind as for an unregistered interface.

Reported-by: syzbot+863936f50214e843ae0c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=863936f50214e843ae0c
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
Root cause: cdc_ncm claims its data interface from probe of the control
interface, before the data interface is registered, so only dev->driver
is set and the bind is left to device_add().  With drivers_autoprobe=0
that bind never happens, so release goes through device_release_driver()
on an interface that was never put on the driver's klist.

Tested with the syzbot C reproducer in QEMU (KASAN, dummy_hcd) on
111dc5487a4e: the baseline oopses in klist_put() in 2 of 6 runs (the
reproducer is racy), the patched kernel in 0 of 10.  A temporary
pr_info confirmed the new path is taken in a run that would otherwise
crash.  The Fixes tag points at the start of git history, as the code
predates it.

 drivers/usb/core/driver.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 7f33fe5ba03b..c7922875dd59 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -636,10 +636,11 @@ void usb_driver_release_interface(struct usb_driver *driver,
 		return;
 	iface->condition = USB_INTERFACE_UNBINDING;
 
-	/* Release via the driver core only if the interface
-	 * has already been registered
+	/* Release via the driver core only if the interface has been
+	 * bound by it.  A claimed interface is not bound if it was
+	 * registered with drivers_autoprobe disabled.
 	 */
-	if (device_is_registered(dev)) {
+	if (device_is_bound(dev)) {
 		device_release_driver(dev);
 	} else {
 		device_lock(dev);
-- 
2.43.0