Re: [PATCH] usbip: fix use-after-free in event_handler()

[Shuah Khan]

On 8/11/26 07:07, Aleksandr Nogikh wrote:
> On Mon, Aug 10, 2026 at 9:33 PM Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> wrote:
> >
> < ... >
> > > During unbinding, we must wait for the scheduled removal event to
> > > finish before we can safely free the device structures. From what I
> > > see in the code, once we have reached wait_event_interruptible(),
> > > there's no way to abort the process or somehow gracefully handle the
> > > error.
> >
> > Yes I agree with you on rewinding being hard.
> >
> > Care to explain the scope of this assist?
> >
> > Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
>
> It was generated by the syzbot's AI patch generation agent:
> https://github.com/google/syzkaller/blob/master/docs/syzbot_ai_patches.md
>
> We manually review the patches it suggests and upstream those we
> believe are fully correct.

As you are reviewing this generated code, did you look into scenarios
where the driver to hang in wait_event()?

thanks,
-- Shuah