From: mosafer <mohsafer@gmail.com>
To: stern@rowland.harvard.edu
Cc: dakr@kernel.org, driver-core@lists.linux.dev,
gregkh@linuxfoundation.org, khiemtranzo532001@gmail.com,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
mohsafer@gmail.com, rafael@kernel.org, stable@vger.kernel.org,
syzbot+863936f50214e843ae0c@syzkaller.appspotmail.com
Subject: Re: [PATCH v2] driver core: complete deferred binds when drivers_autoprobe is off
Date: Sat, 10 Oct 2026 02:00:39 -0500 [thread overview]
Message-ID: <20261010070039.288392-1-mosafer@node0.quickhttpnode15.cloudfaas-pg0.wisc.cloudlab.us> (raw)
In-Reply-To: <0cc7fb74-aa32-427e-a931-dcbac7ffdcf9@rowland.harvard.edu>
On Fri, Oct 09, 2026 at 09:49:49PM -0400, Alan Stern wrote:
> IMO, we do not want the system to limp along forever with the device in
> this "half-bound" state. Claiming an interface should cause the driver
> core to create a real binding at some point in the near future.
>
> This should happen even without automatic probing. For example, if both
> interfaces are unbound and the user writes one of them to the driver's
> "bind" sysfs attribute, both interfaces should end up bound to the
> driver after only a short delay.
Agreed --- that invariant is exactly what this patch restores.
drivers_autoprobe is meant to suppress automatic *matching* against the
bus's driver list; it should not cancel a bind that a driver already
initiated by claiming the interface. With the patch,
usb_driver_claim_interface()'s promise ("let the future device_add()
bind it") is kept at device_add() time regardless of the knob: the
deferred bind completes through device_bind_driver() under the device
lock, so the interface ends up really bound, not half-bound.
To your example: when the claimed interface is already registered,
usb_driver_claim_interface() binds it immediately --- it checks
device_is_registered() and calls device_bind_driver() inline --- so
the manual "bind" attribute case works today and is unaffected by this
patch. The one case where the invariant was broken, and the case the
patch fixes, is a claim made while the sibling interface is not yet
registered and the autoprobe knob happens to be off at its
device_add(): the core silently dropped the promised completion, and
the interface stayed registered with dev->driver set but never bound.
That state is beyond repair from userspace too: writing the interface
to the driver's "bind" attribute cannot complete it --- with
dev->driver pre-assigned, __driver_probe_device() returns -EBUSY (or
the attribute path rejects the device if it does not match the
driver's id table), so interface teardown was the only way out --- and
it oopsed.
The patch keeps the knob's meaning for devices with no claiming
driver: bus-wide matching is still skipped when autoprobe is off (the
check now sits inside __device_attach(), evaluated under the device
lock, per the review-bot finding on v1). On the reproducer that means
the previously-crashing window now ends with a completed bind instead
of an oops, while matching stays suppressed for all the other devices
registered while the knob is off.
If you would rather the same invariant be implemented with a
different mechanism, say the word and I will respin.
Thanks for taking a look,
Mohammad Mosafer
prev parent reply other threads:[~2026-10-10 7:00 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 15:41 [PATCH] driver core: complete deferred binds when drivers_autoprobe is off mosafer
2026-10-08 15:53 ` sashiko-bot
2026-10-08 21:33 ` [PATCH v2] " mosafer
2026-10-08 21:39 ` sashiko-bot
2026-10-09 8:52 ` [PATCH] " Danilo Krummrich
2026-10-09 18:22 ` [PATCH v2] " mosafer
2026-10-09 18:28 ` sashiko-bot
2026-10-10 1:49 ` Alan Stern
2026-10-10 7:00 ` mosafer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261010070039.288392-1-mosafer@node0.quickhttpnode15.cloudfaas-pg0.wisc.cloudlab.us \
--to=mohsafer@gmail.com \
--cc=dakr@kernel.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=khiemtranzo532001@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+863936f50214e843ae0c@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox