Re: [PATCH] usbip: usbip_host: Fix null pointer dereference in rebind_store

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Aug 06, 2026 at 10:47:26AM +0530, Jeffin Philip wrote:
> rebind_store calls do_rebind which dereferences udev without
> checking if it is NULL. If busid is registered using match_busid
> but the device is not present in the first place, it triggers a
> null pointer dereference when we attempt to rebind the device.
> Fix this by checking explicitly for udev first and returning
> -ENODEV if udev is NULL.
> 
> Reported-by: syzbot+af76b01c9a0f0ab60fb0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=af76b01c9a0f0ab60fb0
> Fixes: 4bfb141bc013 ("usbip: usbip_host: fix to hold parent lock for device_attach() calls")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
>  drivers/usb/usbip/stub_main.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
> index 79110a69d697..dfaedecedb81 100644
> --- a/drivers/usb/usbip/stub_main.c
> +++ b/drivers/usb/usbip/stub_main.c
> @@ -256,6 +256,11 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
>  	if (!bid)
>  		return -ENODEV;
>  
> +	if (!bid->udev) {
> +		put_busid_priv(bid);
> +		return -ENODEV;
> +	}

What prevents bid->udev from becoming NULL right after you checked this?

How was this tested?

thanks,

greg k-h