[PATCH v2] usbip: usbip_host: fix null pointer dereference in

[Jeffin Philip]

On Fri, Aug 07, 2026 at 08:00:31 +0200, Greg KH wrote:
>On Fri, Aug 07, 2026 at 10:07:59AM +0530, Jeffin Philip wrote:
>> rebind_store calls do_rebind which dereferences udev without
>> checking if it is NULL. If busid is registered using match_busid
>> but the device is never bound to the driver or it is never present
>> in the first place, it triggers a null pointer dereference when we
>> attempt to rebind the device. Fix this by checking explicitly for
>> udev first and returning -ENODEV if udev is NULL. Add usb_get_dev
>> in addition to the null check to get a reference to udev to prevent
>> udev from becoming NULL after the check. Drop the reference after
>> using it in do_rebind().
>> 
>> Reported-by: syzbot+af76b01c9a0f0ab60fb0@xxxxxxxxxxxxxxxxxxxxxxxxx
>> Closes: https://syzkaller.appspot.com/bug?extid=af76b01c9a0f0ab60fb0
>> Fixes: 4bfb141bc013 ("usbip: usbip_host: fix to hold parent lock for device_attach() calls")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Jeffin Philip <jeffinphilip14@xxxxxxxxx>
>> ---
>> Changes in v2:
>>  - Addressed concerns raised by the maintainer in v1 discussion
>>    - Added usb_get_dev() to get a reference to udev preventing
>>      it from becoming null after the null check. Drop the reference
>>      after using it in do_rebind()
>> ---
>>  drivers/usb/usbip/stub_main.c | 9 +++++++++
>>  1 file changed, 9 insertions(+)
>> 
>> diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
>> index 79110a69d697..c911626427dc 100644
>> --- a/drivers/usb/usbip/stub_main.c
>> +++ b/drivers/usb/usbip/stub_main.c
>> @@ -256,12 +256,21 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
>>  	if (!bid)
>>  		return -ENODEV;
>>  
>> +	if (!bid->udev) {
>> +		put_busid_priv(bid);
>> +		return -ENODEV;
>> +	}
>> +
>> +	/* get a reference to udev to prevent it from becoming NULL */
>> +	usb_get_dev(bid->udev);
>
>So what happens if udev becomes NULL after checking it and before
>grabbing the reference?

I looked through the driver and could not find where udev becomes NULL after
checking and before getting the reference since we do both of those under
busid lock. There is a small window between releasing the lock and
do_rebind, is that what what you are referring to? If so or otherwise, 
could you please advise me on how to move forward in correcting this patch?

Thanks,
Jeffin.