From: Oliver Neukum <oneukum@suse.com>
To: Junzhe Li <ginger.jzllee@gmail.com>, gregkh@linuxfoundation.org
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata()
Date: Thu, 28 May 2026 11:56:55 +0200 [thread overview]
Message-ID: <5099d6cc-c8bc-4fdc-97cf-31e96a57e0c1@suse.com> (raw)
In-Reply-To: <20260528082751.204898-1-ginger.jzllee@gmail.com>
On 28.05.26 10:27, Junzhe Li wrote:
> In yurex_disconnect(), usb_set_intfdata(interface, NULL) was called
> before usb_deregister_dev(interface, &yurex_class).
> This opens a race window with usb_open() in the USB core:
>
> T0 (yurex_disconnect) T1 (usb_open)
> -------------------------- -------------------------
> usb_set_intfdata(iface, NULL) [t0]
> fops = usb_minors[minor] [t1]
> /* fops still valid here */
> usb_deregister_dev()
> usb_minors[minor] = NULL [t2]
> file->f_op->open(inode, file)
> yurex_open()
> dev = usb_get_intfdata() [t3]
> /* dev is NULL! */
Yes, but yurex_open() checks for dev == NULL
Could you please elaborate?
Regards
Oliver
next prev parent reply other threads:[~2026-05-28 9:56 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-28 8:27 [PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata() Junzhe Li
2026-05-28 9:56 ` Oliver Neukum [this message]
2026-05-29 6:58 ` Ginger
2026-05-29 10:31 ` Oliver Neukum
2026-05-29 13:55 ` Ginger
-- strict thread matches above, loose matches on Subject: below --
2026-04-28 4:54 Ginger
2026-04-28 11:58 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5099d6cc-c8bc-4fdc-97cf-31e96a57e0c1@suse.com \
--to=oneukum@suse.com \
--cc=ginger.jzllee@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox