[PATCH 0/2] usbip: stability changes

[PATCH 0/2] usbip: stability changes

[Michael Grzeschik]

While using usbip on kirkwood embedded machine, I came accross
some stability issues. This series is addressing the reference counting
on and usage of the event handler itself.

Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>
---
Michael Grzeschik (2):
      usbip: stub: reference count struct stub_device
      usbip: identify the event handler with current_work()

 drivers/usb/usbip/stub.h         |  3 ++
 drivers/usb/usbip/stub_dev.c     | 69 ++++++++++++++++++++++++++++++++--------
 drivers/usb/usbip/stub_rx.c      |  3 ++
 drivers/usb/usbip/stub_tx.c      |  3 ++
 drivers/usb/usbip/usbip_common.h |  6 ++++
 drivers/usb/usbip/usbip_event.c  | 17 +++++-----
 6 files changed, 79 insertions(+), 22 deletions(-)
---
base-commit: 067c5c24cef23d913b67eaaf71ae67e7169a6620
change-id: 20261111-usbip-fcb6d02254a7

Best regards,
--  
Michael Grzeschik <grzeschik@puzzle.ch>

[PATCH 1/2] usbip: stub: reference count struct stub_device

[Michael Grzeschik]

A stub_device is freed by stub_disconnect() right after usbip_stop_eh()
reported that the event handler is done with it. The rx and tx threads
and the event handler can still use it at that point:

 - The event handler clears an event bit after it ran the handler for
   it. A SHUTDOWN requested while a previous shutdown is running is lost,
   so threads started after that shutdown are not stopped before the
   stub_device is freed.
 - An event queued for the device while another one is handled leaves an
   entry in the event list. Once the event bits are clear,
   usbip_stop_eh() returns, the stub_device is freed, and the handler
   then locks the sysfs_lock of the freed device.
 - The stub_device no longer holds a reference to the usb_device, so a
   thread outliving the disconnect touches a freed usb_device too.

This was seen exporting the serial port of an ST-Link from an
STM32MP1-DK2 on a Kirkwood (ARMv5) host. After repeated "endpoint 5 is
stalled" / usb_clear_halt cycles while a client opened and closed the
port, stub_rx crashed in dev_err() with the device pointer computed from
a NULL sdev->udev of freed memory:

  Unable to handle kernel NULL pointer dereference at virtual address 000000b8 when read
  PC is at dev_driver_string+0x0/0x38
  LR is at __dev_printk+0x20/0x6c
  Call trace:
   dev_driver_string from __dev_printk+0x20/0x6c
   __dev_printk from _dev_err+0x40/0x74
   _dev_err from stub_rx_loop+0x5d8/0xd68 [usbip_host]
   stub_rx_loop [usbip_host] from kthread+0x100/0x120

Reference count the stub_device instead of relying on the event handler
for its lifetime:

 - the binding (probe until disconnect) holds the initial reference,
   stub_disconnect() drops it instead of freeing the device
 - the rx and tx thread hold one each while they run, taken before they
   are woken and dropped when they end. If kthread_stop() reports that a
   thread never ran, stub_shutdown_connection() drops it for the thread.
 - the event handler holds one per queued event until it is completely
   done with the device, through new optional get/put event handler
   operations, which vhci and vudc do not set
 - the stub_device holds a reference to its usb_device again, dropped
   with the last reference

Threads that miss their shutdown now end when the connection goes away
instead of using freed memory.

Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>
---
 drivers/usb/usbip/stub.h         |  3 ++
 drivers/usb/usbip/stub_dev.c     | 69 ++++++++++++++++++++++++++++++++--------
 drivers/usb/usbip/stub_rx.c      |  3 ++
 drivers/usb/usbip/stub_tx.c      |  3 ++
 drivers/usb/usbip/usbip_common.h |  6 ++++
 drivers/usb/usbip/usbip_event.c  |  6 ++++
 6 files changed, 77 insertions(+), 13 deletions(-)

diff --git a/drivers/usb/usbip/stub.h b/drivers/usb/usbip/stub.h
index d11270560c24..fa40f349d640 100644
--- a/drivers/usb/usbip/stub.h
+++ b/drivers/usb/usbip/stub.h
@@ -6,6 +6,7 @@
 #ifndef __USBIP_STUB_H
 #define __USBIP_STUB_H
 
+#include <linux/kref.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
@@ -20,6 +21,7 @@
 
 struct stub_device {
 	struct usb_device *udev;
+	struct kref kref;
 
 	struct usbip_device ud;
 	__u32 devid;
@@ -85,6 +87,7 @@ extern struct kmem_cache *stub_priv_cache;
 
 /* stub_dev.c */
 extern struct usb_device_driver stub_driver;
+void stub_device_put(struct stub_device *sdev);
 
 /* stub_main.c */
 struct bus_id_priv *get_busid_priv(const char *busid);
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index abfa11d6bde7..27d1e9c8db17 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -11,6 +11,42 @@
 #include "usbip_common.h"
 #include "stub.h"
 
+/*
+ * A stub_device is referenced by its binding to the USB device (from probe
+ * until disconnect), by the rx and tx threads while they run, and by the
+ * event handler while an event for it is queued or being handled. It must
+ * not be freed before all of them are done with it: stopping the threads
+ * relies on the event handler, which can miss a shutdown request or still
+ * have an event queued when disconnect wants to free the device.
+ */
+static void stub_device_release(struct kref *kref)
+{
+	struct stub_device *sdev = container_of(kref, struct stub_device, kref);
+
+	usb_put_dev(sdev->udev);
+	kfree(sdev);
+}
+
+static void stub_device_get(struct stub_device *sdev)
+{
+	kref_get(&sdev->kref);
+}
+
+void stub_device_put(struct stub_device *sdev)
+{
+	kref_put(&sdev->kref, stub_device_release);
+}
+
+static void stub_eh_get(struct usbip_device *ud)
+{
+	stub_device_get(container_of(ud, struct stub_device, ud));
+}
+
+static void stub_eh_put(struct usbip_device *ud)
+{
+	stub_device_put(container_of(ud, struct stub_device, ud));
+}
+
 /*
  * usbip_status shows the status of usbip-host as long as this driver is bound
  * to the target device.
@@ -101,6 +137,10 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
 		get_task_struct(tcp_rx);
 		get_task_struct(tcp_tx);
 
+		/* one reference per thread, dropped when the thread ends */
+		stub_device_get(sdev);
+		stub_device_get(sdev);
+
 		/* lock and update sdev->ud state */
 		spin_lock_irq(&sdev->ud.lock);
 		sdev->ud.tcp_socket = socket;
@@ -165,13 +205,18 @@ static void stub_shutdown_connection(struct usbip_device *ud)
 		kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
 	}
 
-	/* 1. stop threads */
+	/*
+	 * 1. stop threads. A thread that was stopped before it ran
+	 * (-EINTR) did not drop its reference itself.
+	 */
 	if (ud->tcp_rx) {
-		kthread_stop_put(ud->tcp_rx);
+		if (kthread_stop_put(ud->tcp_rx) == -EINTR)
+			stub_device_put(sdev);
 		ud->tcp_rx = NULL;
 	}
 	if (ud->tcp_tx) {
-		kthread_stop_put(ud->tcp_tx);
+		if (kthread_stop_put(ud->tcp_tx) == -EINTR)
+			stub_device_put(sdev);
 		ud->tcp_tx = NULL;
 	}
 
@@ -267,7 +312,8 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
 	if (!sdev)
 		return NULL;
 
-	sdev->udev = udev;
+	kref_init(&sdev->kref);
+	sdev->udev = usb_get_dev(udev);
 
 	/*
 	 * devid is defined with devnum when this driver is first allocated.
@@ -294,6 +340,8 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
 	sdev->ud.eh_ops.shutdown = stub_shutdown_connection;
 	sdev->ud.eh_ops.reset    = stub_device_reset;
 	sdev->ud.eh_ops.unusable = stub_device_unusable;
+	sdev->ud.eh_ops.get      = stub_eh_get;
+	sdev->ud.eh_ops.put      = stub_eh_put;
 
 	usbip_start_eh(&sdev->ud);
 
@@ -302,11 +350,6 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
 	return sdev;
 }
 
-static void stub_device_free(struct stub_device *sdev)
-{
-	kfree(sdev);
-}
-
 static int stub_probe(struct usb_device *udev)
 {
 	struct stub_device *sdev = NULL;
@@ -409,7 +452,7 @@ static int stub_probe(struct usb_device *udev)
 	put_busid_priv(busid_priv);
 
 sdev_free:
-	stub_device_free(sdev);
+	stub_device_put(sdev);
 
 	return rc;
 }
@@ -489,15 +532,15 @@ static void stub_disconnect(struct usb_device *udev)
 
 	/* we already have busid_priv, just lock busid_lock */
 	spin_lock(&busid_priv->busid_lock);
-	/* free sdev */
 	busid_priv->sdev = NULL;
-	stub_device_free(sdev);
 
 	if (busid_priv->status == STUB_BUSID_ALLOC)
 		busid_priv->status = STUB_BUSID_ADDED;
 	/* release busid_lock */
 	spin_unlock(&busid_priv->busid_lock);
-	return;
+
+	/* drop the reference of the binding, threads may still hold theirs */
+	stub_device_put(sdev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 1e9ae578810d..63571b690f14 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -707,5 +707,8 @@ int stub_rx_loop(void *data)
 		stub_rx_pdu(ud);
 	}
 
+	/* drop the reference taken in usbip_sockfd_store() */
+	stub_device_put(container_of(ud, struct stub_device, ud));
+
 	return 0;
 }
diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index 4ffd342250b5..44b3e870456c 100644
--- a/drivers/usb/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
@@ -446,5 +446,8 @@ int stub_tx_loop(void *data)
 					  kthread_should_stop()));
 	}
 
+	/* drop the reference taken in usbip_sockfd_store() */
+	stub_device_put(sdev);
+
 	return 0;
 }
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index be4c5e65a7f8..dfacd8530db8 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -280,6 +280,12 @@ struct usbip_device {
 		void (*shutdown)(struct usbip_device *);
 		void (*reset)(struct usbip_device *);
 		void (*unusable)(struct usbip_device *);
+		/*
+		 * Optional: hold a reference while an event for this device is
+		 * queued for or being handled by the event handler.
+		 */
+		void (*get)(struct usbip_device *ud);
+		void (*put)(struct usbip_device *ud);
 	} eh_ops;
 
 	struct kcov_common_handle_id kcov_handle;
diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 0e00c2d000f8..eea9a71f0eac 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -94,6 +94,10 @@ static void event_handler(struct work_struct *work)
 		mutex_unlock(&ud->sysfs_lock);
 
 		wake_up(&ud->eh_waitq);
+
+		/* drop the reference taken by usbip_event_add() */
+		if (ud->eh_ops.put)
+			ud->eh_ops.put(ud);
 	}
 }
 
@@ -163,6 +167,8 @@ void usbip_event_add(struct usbip_device *ud, unsigned long event)
 		goto out;
 
 	ue->ud = ud;
+	if (ud->eh_ops.get)
+		ud->eh_ops.get(ud);
 
 	list_add_tail(&ue->node, &event_list);
 	queue_work(usbip_queue, &usbip_work);

-- 
2.53.0

[PATCH 2/2] usbip: identify the event handler with current_work()

[Michael Grzeschik]

usbip_in_eh() compares the task with worker_context, the first worker
that ever ran the event handler. Workers of the unbound usbip_event
workqueue are reaped when idle and new ones run the handler later, so the
check fails inside the event handler, and the remembered task_struct may
be reused by any other task, which then wrongly counts as the event
handler. stub_disconnect() relies on it to skip the shutdown of a device
reset from the event handler.

Ask the workqueue which work item the current task executes instead.

Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>
---
 drivers/usb/usbip/usbip_event.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index eea9a71f0eac..e00bc535a822 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -57,16 +57,11 @@ static struct usbip_device *get_event(void)
 	return ud;
 }
 
-static struct task_struct *worker_context;
 
 static void event_handler(struct work_struct *work)
 {
 	struct usbip_device *ud;
 
-	if (worker_context == NULL) {
-		worker_context = current;
-	}
-
 	while ((ud = get_event()) != NULL) {
 		usbip_dbg_eh("pending event %lx\n", ud->event);
 
@@ -194,9 +189,7 @@ EXPORT_SYMBOL_GPL(usbip_event_happened);
 
 int usbip_in_eh(struct task_struct *task)
 {
-	if (task == worker_context)
-		return 1;
-
-	return 0;
+	/* only the worker running usbip_work is the event handler */
+	return task == current && current_work() == &usbip_work;
 }
 EXPORT_SYMBOL_GPL(usbip_in_eh);

-- 
2.53.0

Re: [PATCH 2/2] usbip: identify the event handler with current_work()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] usbip: missing Fixes: trailer for commit bb7871ad99ea
--

commit 823e2d0c8c9cae9400078a44aab5ee7919c0b1e1
Author: Michael Grzeschik <grzeschik@puzzle.ch>

> usbip: identify the event handler with current_work()
>
> usbip_in_eh() compares the task with worker_context, the first worker
> that ever ran the event handler. Workers of the unbound usbip_event
> workqueue are reaped when idle and new ones run the handler later, so the
> check fails inside the event handler, and the remembered task_struct may
> be reused by any other task, which then wrongly counts as the event
> handler. stub_disconnect() relies on it to skip the shutdown of a device
> reset from the event handler.
>
> Ask the workqueue which work item the current task executes instead.
>
> Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>

[Severity: Low]
This fixes the worker_context check introduced when the event handler was
converted to a workqueue.  Should this include:

  Fixes: bb7871ad99ea ("usbip: event handler as one thread")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-usbip-v1-0-da5217ac71d7@puzzle.ch?part=2

Re: [PATCH 1/2] usbip: stub: reference count struct stub_device

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] usbip: stub: hung stub_tx, leaks, and URB UAF when shutdown is
  missed
- [Medium] usbip: use-after-free in event_handler() reading eh_ops.put
  after wake_up()
--

commit cd9a80911da15b88ceb306a5e8d623b311108647
Author: Michael Grzeschik <grzeschik@puzzle.ch>

usbip: stub: reference count struct stub_device

This commit adds kref reference counting to struct stub_device and holds
references across device binding, the rx/tx kthreads, and queued events so
that stub_device and its usb_device are not freed while still in use.

> diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
> index abfa11d6bde79..27d1e9c8db176 100644
> --- a/drivers/usb/usbip/stub_dev.c
> +++ b/drivers/usb/usbip/stub_dev.c
> @@ -11,6 +11,42 @@
>  #include "usbip_common.h"
>  #include "stub.h"
>  
> +/*
> + * A stub_device is referenced by its binding to the USB device (from probe
> + * until disconnect), by the rx and tx threads while they run, and by the
> + * event handler while an event for it is queued or being handled. It must
> + * not be freed before all of them are done with it: stopping the threads
> + * relies on the event handler, which can miss a shutdown request or still
> + * have an event queued when disconnect wants to free the device.
> + */
> +static void stub_device_release(struct kref *kref)
> +{
> +	struct stub_device *sdev = container_of(kref, struct stub_device, kref);
> +
> +	usb_put_dev(sdev->udev);
> +	kfree(sdev);
> +}

[Severity: High]
If the rx and tx threads outlive stub_disconnect() because
stub_shutdown_connection() was missed, does stub_tx_loop() hang forever on
sdev->tx_waitq, or does stub_device_release() free sdev while in-flight
URBs and connection resources are still active?

Once shutdown_busid() queues SDEV_EVENT_REMOVED during stub_disconnect(),
USBIP_EH_BYE is set in ud->event, which causes any later usbip_event_add()
call to return early without scheduling stub_shutdown_connection():

drivers/usb/usbip/usbip_event.c:usbip_event_add() {
	if (ud->event & USBIP_EH_BYE)
		return;
}

Without stub_shutdown_connection() calling kthread_stop_put(ud->tcp_tx),
stub_tx_loop() blocks indefinitely in wait_event_interruptible() on
sdev->tx_waitq because neither socket closure nor usbip_event_add() wakes
that queue.

Even if both threads exit on a socket error and drop their references,
stub_device_release() only drops sdev->udev and frees sdev without running
the cleanup from stub_shutdown_connection().  That leaks the ud->tcp_rx and
ud->tcp_tx task structs, ud->tcp_socket, and the sdev->unlink_tx and
sdev->unlink_free lists, and leaves in-flight URBs on sdev->priv_init to
dereference the freed sdev in stub_complete().  In addition, letting
stub_disconnect() return while threads or events are still running allows
usbip_host_exit() to destroy stub_priv_cache and finish unloading the
module while sdev is still in use.

[ ... ]

> diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
> index 0e00c2d000f89..eea9a71f0eac2 100644
> --- a/drivers/usb/usbip/usbip_event.c
> +++ b/drivers/usb/usbip/usbip_event.c
> @@ -94,6 +94,10 @@ static void event_handler(struct work_struct *work)
>  		mutex_unlock(&ud->sysfs_lock);
>  
>  		wake_up(&ud->eh_waitq);
> +
> +		/* drop the reference taken by usbip_event_add() */
> +		if (ud->eh_ops.put)
> +			ud->eh_ops.put(ud);
>  	}
>  }

[Severity: Medium]
Can waking ud->eh_waitq before reading ud->eh_ops.put cause a
use-after-free on ud?

vhci and vudc do not set eh_ops.get or eh_ops.put, and their removal paths
free the enclosing device as soon as usbip_stop_eh() returns from waiting
on ud->eh_waitq:

CPU0 (event_handler)              CPU1 (vudc_remove)
unset_event(ud, ...)
wake_up(&ud->eh_waitq)
                                  usb_del_gadget_udc()
                                    vgadget_pullup()
                                      usbip_stop_eh(&udc->ud)  /* returns */
                                  kfree(udc)
if (ud->eh_ops.put)  <-- use-after-free

For stub_device, waking usbip_stop_eh() before ud->eh_ops.put(ud) runs (or
while a second event queued for the same ud is still on event_list) also
lets stub_disconnect() and usbip_host_exit() finish unloading usbip-host.ko
while event_handler() in usbip-core.ko is still about to call
stub_eh_put().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-usbip-v1-0-da5217ac71d7@puzzle.ch?part=1

Re: [PATCH 2/2] usbip: identify the event handler with current_work()

[John Ernberg]

Hi Michael,

On 11/11/2026 12:34, Michael Grzeschik wrote:
> usbip_in_eh() compares the task with worker_context, the first worker
> that ever ran the event handler. Workers of the unbound usbip_event
> workqueue are reaped when idle and new ones run the handler later, so the
> check fails inside the event handler, and the remembered task_struct may
> be reused by any other task, which then wrongly counts as the event
> handler. stub_disconnect() relies on it to skip the shutdown of a device
> reset from the event handler.
> 
> Ask the workqueue which work item the current task executes instead.
> 
> Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>

We sent a similar patch back in August that we forgot to follow up on. [1]

Reviewed-by: John Ernberg <john.ernberg@actia.se>

[1]: 
https://lore.kernel.org/linux-usb/20260803104342.2790105-1-john.ernberg@actia.se/

Thanks! // John Ernberg

Re: [PATCH 2/2] usbip: identify the event handler with current_work()

[Michael Grzeschik]

[-- Attachment #1.1: Type: text/plain, Size: 1214 bytes --]

Hi John

On 2026-11-11 4:35 PM, John Ernberg wrote:
> Hi Michael,
> 
> On 11/11/2026 12:34, Michael Grzeschik wrote:
>> usbip_in_eh() compares the task with worker_context, the first worker
>> that ever ran the event handler. Workers of the unbound usbip_event
>> workqueue are reaped when idle and new ones run the handler later, so the
>> check fails inside the event handler, and the remembered task_struct may
>> be reused by any other task, which then wrongly counts as the event
>> handler. stub_disconnect() relies on it to skip the shutdown of a device
>> reset from the event handler.
>>
>> Ask the workqueue which work item the current task executes instead.
>>
>> Signed-off-by: Michael Grzeschik <grzeschik@puzzle.ch>
> 
> We sent a similar patch back in August that we forgot to follow up on. [1]
> 
> Reviewed-by: John Ernberg <john.ernberg@actia.se>
> 
> [1]: https://lore.kernel.org/linux-usb/20260803104342.2790105-1-john.ernberg@actia.se/

Damn, I really should have checked the usb list better before sending my change.
Please lets use your change then. I will just send my Reviewed-by and push for your contribution.

So please ignore this mail.

Thanks,
Michael

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]