Re: [PATCH v3] driver core: take parent lock in async device attach

[Johan Hovold <johan@kernel.org>]

On Tue, Oct 13, 2026 at 03:41:28PM +0000, PETER Mario wrote:
> On 10/13/26 16:04, Johan Hovold wrote:

> > @@ -1038,7 +1070,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
> >                 .want_async     = true,
> >         };
> > 
> > -       device_lock(dev);
> > +       __device_driver_lock(dev, dev->parent);
> 
> Thanks for picking this up and for fixing the deadlock.
> 
> The use-after-free that the AI review flags here is real, I can
> trigger it in QEMU. With a debug delay before this line,
> driver_async_probe=usb,hub, and dummy_hcd unbound while the probe of
> the emulated hub's usb_device waited, KASAN reports a
> slab-use-after-free in __mutex_lock() called from
> __device_attach_async_helper(), on the root hub. An interface pins its
> usb_device, but a usb_device doesn't pin its parent hub, and dev drops
> its reference to the parent in device_del(). v2 has the same problem.

Thanks for checking. I can also trigger a UAF through some existing
paths when disconnecting a hub (with some instrumentation to increase
the race window).

I've just sent a v2 series for the deferred probe fix that also
addresses the UAF issue and includes your fix:

	https://lore.kernel.org/all/20261014133109.1392265-1-johan@kernel.org/

Johan