Re: [PATCH v2] driver core: avoid klist_remove() on unattached knode_driver

[Greg KH]

On Thu, Aug 20, 2026 at 02:05:23PM +0800, Nguyen Quang Le Kien wrote:
> usb_driver_claim_interface() sets dev->driver directly and skips
> device_bind_driver() when the interface is not yet registered, so the
> device can reach teardown with dev->driver set but knode_driver never
> added to the driver's klist_devices. __device_release_driver() then
> unconditionally calls klist_remove() on the unattached node, which
> dereferences a NULL klist pointer in klist_put() and crashes.
> 
> Only remove the node if the device is actually bound, mirroring the
> check device_is_bound() already provides for the driver core. This
> matches the existing guard on knode_bus in bus_remove_device().
> 
> Reported-by: syzbot+87188222c77c0dbbdb4d@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@xxxxxxxxx>
> ---
>  drivers/base/dd.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

What changed from v1?

And why did you send the same patch as Edward Adam Davis <eadavis@xxxxxx>
just did:
	https://lore.kernel.org/r/tencent_0B76C5676E3DA13640962637444B28743709@xxxxxx

What is suddenly causing people to care about syzbot bugs for USB?

thanks,

greg k-h