Re: [PATCH v3] driver core: take parent lock in async device attach

[PETER Mario]

Hi Johan,

On 10/13/26 16:04, Johan Hovold wrote:
> @@ -1038,7 +1070,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
>                 .want_async     = true,
>         };
> 
> -       device_lock(dev);
> +       __device_driver_lock(dev, dev->parent);

Thanks for picking this up and for fixing the deadlock.

The use-after-free that the AI review flags here is real, I can
trigger it in QEMU. With a debug delay before this line,
driver_async_probe=usb,hub, and dummy_hcd unbound while the probe of
the emulated hub's usb_device waited, KASAN reports a
slab-use-after-free in __mutex_lock() called from
__device_attach_async_helper(), on the root hub. An interface pins its
usb_device, but a usb_device doesn't pin its parent hub, and dev drops
its reference to the parent in device_del(). v2 has the same problem.

Mario