[PATCH] USB: core: document purpose of interface parent reference

[PATCH] USB: core: document purpose of interface parent reference

[Johan Hovold]

USB interfaces hold a reference to their parent USB device to make sure
they do not outlive the parent.

Add a comment explaining that this reference is specifically needed for
asynchronous device resets and the device type need_parent_lock feature
(to allow driver core to lock the parent when only holding a reference
to the interface).

See commits:

  524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
  af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")

for further details.

Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/core/message.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 276768f47558..a738d03c23ea 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		pm_runtime_no_callbacks(&intf->dev);
 		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
 				dev->devpath, configuration, ifnum);
+		/*
+		 * Make sure the interface does not outlive its parent (e.g.
+		 * as needed for usb_queue_reset_device() and
+		 * usb_if_device_type->need_parent_lock).
+		 */
 		usb_get_dev(dev);
 	}
 	kfree(new_interfaces);
-- 
2.55.0

Re: [PATCH] USB: core: document purpose of interface parent reference

[sashiko-bot]

> USB interfaces hold a reference to their parent USB device to make sure
> they do not outlive the parent.
> 
> Add a comment explaining that this reference is specifically needed for
> asynchronous device resets and the device type need_parent_lock feature
> (to allow driver core to lock the parent when only holding a reference
> to the interface).
> 
> See commits:
> 
>   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
>   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> 
> for further details.
> 
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015074831.1418677-1-johan@kernel.org?part=1

Re: [PATCH] USB: core: document purpose of interface parent reference

[Danilo Krummrich]

On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> USB interfaces hold a reference to their parent USB device to make sure
> they do not outlive the parent.
>
> Add a comment explaining that this reference is specifically needed for
> asynchronous device resets and the device type need_parent_lock feature
> (to allow driver core to lock the parent when only holding a reference
> to the interface).
>
> See commits:
>
>   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
>   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
>
> for further details.
>
> Signed-off-by: Johan Hovold <johan@kernel.org>

NIT: Maybe add that the reference count must be held until release().

In any case,

Reviewed-by: Danilo Krummrich <dakr@kernel.org>

> ---
>  drivers/usb/core/message.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 276768f47558..a738d03c23ea 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
>  		pm_runtime_no_callbacks(&intf->dev);
>  		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
>  				dev->devpath, configuration, ifnum);
> +		/*
> +		 * Make sure the interface does not outlive its parent (e.g.
> +		 * as needed for usb_queue_reset_device() and
> +		 * usb_if_device_type->need_parent_lock).
> +		 */
>  		usb_get_dev(dev);
>  	}
>  	kfree(new_interfaces);
> -- 
> 2.55.0

Re: [PATCH] USB: core: document purpose of interface parent reference

[Johan Hovold]

On Thu, Oct 15, 2026 at 10:08:36AM +0200, Danilo Krummrich wrote:
> On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > USB interfaces hold a reference to their parent USB device to make sure
> > they do not outlive the parent.
> >
> > Add a comment explaining that this reference is specifically needed for
> > asynchronous device resets and the device type need_parent_lock feature
> > (to allow driver core to lock the parent when only holding a reference
> > to the interface).
> >
> > See commits:
> >
> >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> >
> > for further details.
> >
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> 
> NIT: Maybe add that the reference count must be held until release().

I think that's implied as the comment refers to the lifetime of these
objects.

> In any case,
> 
> Reviewed-by: Danilo Krummrich <dakr@kernel.org>

Thanks for reviewing.

> > @@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
> >  		pm_runtime_no_callbacks(&intf->dev);
> >  		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
> >  				dev->devpath, configuration, ifnum);
> > +		/*
> > +		 * Make sure the interface does not outlive its parent (e.g.
> > +		 * as needed for usb_queue_reset_device() and
> > +		 * usb_if_device_type->need_parent_lock).
> > +		 */
> >  		usb_get_dev(dev);
> >  	}

Johan

Re: [PATCH] USB: core: document purpose of interface parent reference

[Danilo Krummrich]

On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> See commits:
>
>   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
>   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
>
> for further details.

The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
on USB disconnect"), and queued for a -fixes PR mid merge window.

Greg, please let me know if you want me to include this one, or if you will take
it after -rc1 ist out.

Thanks,
Danilo

Re: [PATCH] USB: core: document purpose of interface parent reference

[Greg Kroah-Hartman]

On Fri, Oct 16, 2026 at 10:54:17PM +0200, Danilo Krummrich wrote:
> On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > See commits:
> >
> >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> >
> > for further details.
> 
> The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
> on USB disconnect"), and queued for a -fixes PR mid merge window.
> 
> Greg, please let me know if you want me to include this one, or if you will take
> it after -rc1 ist out.

I just grabbed it now, thanks.

greg k-h

Re: [PATCH] USB: core: document purpose of interface parent reference

[Johan Hovold]

On Sat, Oct 17, 2026 at 10:18:08AM +0200, Greg Kroah-Hartman wrote:
> On Fri, Oct 16, 2026 at 10:54:17PM +0200, Danilo Krummrich wrote:
> > On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > > See commits:
> > >
> > >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> > >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> > >
> > > for further details.
> > 
> > The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
> > on USB disconnect"), and queued for a -fixes PR mid merge window.
> > 
> > Greg, please let me know if you want me to include this one, or if you will take
> > it after -rc1 ist out.
> 
> I just grabbed it now, thanks.

I should have waited a bit with posting this one.

The commit id mentioned in the commit message above was changed when the
driver core commit was moved from driver-core-testing to the
driver-core-linus branch. I guess we can always find it via the patch
link (or commit summary).

Johan

Re: [PATCH] USB: core: document purpose of interface parent reference

[Greg Kroah-Hartman]

On Sat, Oct 17, 2026 at 10:28:32AM +0200, Johan Hovold wrote:
> On Sat, Oct 17, 2026 at 10:18:08AM +0200, Greg Kroah-Hartman wrote:
> > On Fri, Oct 16, 2026 at 10:54:17PM +0200, Danilo Krummrich wrote:
> > > On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > > > See commits:
> > > >
> > > >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> > > >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> > > >
> > > > for further details.
> > > 
> > > The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
> > > on USB disconnect"), and queued for a -fixes PR mid merge window.
> > > 
> > > Greg, please let me know if you want me to include this one, or if you will take
> > > it after -rc1 ist out.
> > 
> > I just grabbed it now, thanks.
> 
> I should have waited a bit with posting this one.
> 
> The commit id mentioned in the commit message above was changed when the
> driver core commit was moved from driver-core-testing to the
> driver-core-linus branch. I guess we can always find it via the patch
> link (or commit summary).

I can still edit this as it's not really lived long in my branch, what
should the text be here?

thanks,

greg k-h

Re: [PATCH] USB: core: document purpose of interface parent reference

[Johan Hovold]

On Sat, Oct 17, 2026 at 10:49:57AM +0200, Greg Kroah-Hartman wrote:
> On Sat, Oct 17, 2026 at 10:28:32AM +0200, Johan Hovold wrote:
> > On Sat, Oct 17, 2026 at 10:18:08AM +0200, Greg Kroah-Hartman wrote:
> > > On Fri, Oct 16, 2026 at 10:54:17PM +0200, Danilo Krummrich wrote:
> > > > On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > > > > See commits:
> > > > >
> > > > >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> > > > >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> > > > >
> > > > > for further details.
> > > > 
> > > > The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
> > > > on USB disconnect"), and queued for a -fixes PR mid merge window.
> > > > 
> > > > Greg, please let me know if you want me to include this one, or if you will take
> > > > it after -rc1 ist out.
> > > 
> > > I just grabbed it now, thanks.
> > 
> > I should have waited a bit with posting this one.
> > 
> > The commit id mentioned in the commit message above was changed when the
> > driver core commit was moved from driver-core-testing to the
> > driver-core-linus branch. I guess we can always find it via the patch
> > link (or commit summary).
> 
> I can still edit this as it's not really lived long in my branch, what
> should the text be here?

The second reference should be:

	0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect")

Thanks!

Johan

Re: [PATCH] USB: core: document purpose of interface parent reference

[Greg Kroah-Hartman]

On Sat, Oct 17, 2026 at 10:57:13AM +0200, Johan Hovold wrote:
> On Sat, Oct 17, 2026 at 10:49:57AM +0200, Greg Kroah-Hartman wrote:
> > On Sat, Oct 17, 2026 at 10:28:32AM +0200, Johan Hovold wrote:
> > > On Sat, Oct 17, 2026 at 10:18:08AM +0200, Greg Kroah-Hartman wrote:
> > > > On Fri, Oct 16, 2026 at 10:54:17PM +0200, Danilo Krummrich wrote:
> > > > > On Thu Oct 15, 2026 at 9:48 AM CEST, Johan Hovold wrote:
> > > > > > See commits:
> > > > > >
> > > > > >   524134d42231 ("USB: don't cancel queued resets when unbinding drivers")
> > > > > >   af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
> > > > > >
> > > > > > for further details.
> > > > > 
> > > > > The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free
> > > > > on USB disconnect"), and queued for a -fixes PR mid merge window.
> > > > > 
> > > > > Greg, please let me know if you want me to include this one, or if you will take
> > > > > it after -rc1 ist out.
> > > > 
> > > > I just grabbed it now, thanks.
> > > 
> > > I should have waited a bit with posting this one.
> > > 
> > > The commit id mentioned in the commit message above was changed when the
> > > driver core commit was moved from driver-core-testing to the
> > > driver-core-linus branch. I guess we can always find it via the patch
> > > link (or commit summary).
> > 
> > I can still edit this as it's not really lived long in my branch, what
> > should the text be here?
> 
> The second reference should be:
> 
> 	0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect")

Now fixed up, thanks.

greg k-h