Forwarded: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [PATCH] usb: core: fix GPF on disconnect when interface claimed before registration
Author: khiemtranzo532001@xxxxxxxxx

#syz test

usb_driver_claim_interface() sets dev->driver unconditionally before
checking device_is_registered(dev).  When called from usb_audio_probe()
during configuration, the interface device has not been added to the
driver core yet (device_add() is called later in usb_set_configuration()).

As a result, knode_driver is never attached to the driver's klist, but
dev->driver is set.  On subsequent disconnect, bus_remove_device() calls
__device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
unconditionally on the uninitialized node, causing a general protection
fault:

  BUG: kernel NULL pointer dereference
  RIP: klist_remove+0x...
  Call Trace:
   __device_release_driver
   bus_remove_device
   device_del
   usb_disable_device
   usb_disconnect

Fix this by deferring the assignment of dev->driver for interfaces that
are not yet registered.  Instead, record the claim via two new fields in
struct usb_interface: a claimed bitflag and a claimed_driver pointer.
After device_add() completes in usb_set_configuration(), call
device_bind_driver() explicitly for claimed interfaces.

device_bind_driver() skips ->probe() (which is exactly what usb_audio
needs — PCM and MIDI devices are created before bind), but it does
attach knode_driver to the driver's klist, making teardown safe.

The else-if branch in dd.c that handles dev->driver already set at
device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
others) is intentionally left untouched.

Reported-by: syzbot+87188222c77c0dbbdb4d@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@xxxxxxxxx>
---
 drivers/usb/core/driver.c  | 19 ++++++++++++++-----
 drivers/usb/core/message.c | 15 +++++++++++++++
 include/linux/usb.h        |  2 ++
 3 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f63004417..59e74872b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
        if (!iface->authorized)
                return -ENODEV;

-       dev->driver = &driver->driver;
        usb_set_intfdata(iface, data);
        iface->needs_binding = 0;

@@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
*driver,
        else
                pm_runtime_set_active(dev);

-       /* if interface was already added, bind now; else let
-        * the future device_add() bind it, bypassing probe()
-        */
-       if (device_is_registered(dev))
+       if (device_is_registered(dev)) {
+               dev->driver = &driver->driver;
                retval = device_bind_driver(dev);
+       } else {
+               /*
+                * Interface not yet registered: record the claim without
+                * setting dev->driver.  usb_set_configuration() will call
+                * device_bind_driver() explicitly after device_add(), which
+                * skips ->probe() and attaches knode_driver so teardown is
safe.
+                */
+               iface->claimed = 1;
+               iface->claimed_driver = driver;
+       }

        if (retval) {
                dev->driver = NULL;
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 75e2bfd74..73c630750 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
int configuration)
                if (ret != 0) {
                        dev_err(&dev->dev, "device_add(%s) --> %d\n",
                                dev_name(&intf->dev), ret);
+                       intf->claimed = 0;
+                       intf->claimed_driver = NULL;
                        continue;
                }
+               if (intf->claimed) {
+                       intf->dev.driver = &intf->claimed_driver->driver;
+                       ret = device_bind_driver(&intf->dev);
+                       if (ret) {
+                               dev_err(&dev->dev,
+                                       "device_bind_driver(%s) --> %d\n",
+                                       dev_name(&intf->dev), ret);
+                               intf->dev.driver = NULL;
+                               intf->condition = USB_INTERFACE_UNBOUND;
+                       }
+                       intf->claimed = 0;
+                       intf->claimed_driver = NULL;
+               }
                create_intf_ep_devs(intf);
        }

diff --git a/include/linux/usb.h b/include/linux/usb.h
index 1da4ad161..0ec743e76 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -266,6 +266,8 @@ struct usb_interface {
        unsigned needs_binding:1;       /* needs delayed unbind/rebind */
        unsigned resetting_device:1;    /* true: bandwidth alloc after
reset */
        unsigned authorized:1;          /* used for interface authorization
*/
+       unsigned claimed:1;             /* driver claimed before
device_add() */
+       struct usb_driver *claimed_driver;      /* driver for deferred bind
*/
        enum usb_wireless_status wireless_status;
        struct work_struct wireless_status_work;
--
2.34.1

On Thu, Sep 3, 2026 at 1:30 PM Akihiko Kai <khiemtranzo532001@xxxxxxxxx>
wrote:

> usb_driver_claim_interface() sets dev->driver unconditionally before
> checking device_is_registered(dev).  When called from usb_audio_probe()
> during configuration, the interface device has not been added to the
> driver core yet (device_add() is called later in usb_set_configuration()).
>
> As a result, knode_driver is never attached to the driver's klist, but
> dev->driver is set.  On subsequent disconnect, bus_remove_device() calls
> __device_release_driver(), which calls klist_remove(&dev->p->knode_driver)
> unconditionally on the uninitialized node, causing a general protection
> fault:
>
>   BUG: kernel NULL pointer dereference
>   RIP: klist_remove+0x...
>   Call Trace:
>    __device_release_driver
>    bus_remove_device
>    device_del
>    usb_disable_device
>    usb_disconnect
>
> Fix this by deferring the assignment of dev->driver for interfaces that
> are not yet registered.  Instead, record the claim via two new fields in
> struct usb_interface: a claimed bitflag and a claimed_driver pointer.
> After device_add() completes in usb_set_configuration(), call
> device_bind_driver() explicitly for claimed interfaces.
>
> device_bind_driver() skips ->probe() (which is exactly what usb_audio
> needs — PCM and MIDI devices are created before bind), but it does
> attach knode_driver to the driver's klist, making teardown safe.
>
> The else-if branch in dd.c that handles dev->driver already set at
> device_add() time (used by w1, usb_port, ccwgroup, pata_parport, and
> others) is intentionally left untouched.
>
> Reported-by: syzbot+87188222c77c0dbbdb4d@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@xxxxxxxxx>
> ---
>  drivers/usb/core/driver.c  | 19 ++++++++++++++-----
>  drivers/usb/core/message.c | 15 +++++++++++++++
>  include/linux/usb.h        |  2 ++
>  3 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
> index f63004417..59e74872b 100644
> --- a/drivers/usb/core/driver.c
> +++ b/drivers/usb/core/driver.c
> @@ -562,7 +562,6 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
>         if (!iface->authorized)
>                 return -ENODEV;
>
> -       dev->driver = &driver->driver;
>         usb_set_intfdata(iface, data);
>         iface->needs_binding = 0;
>
> @@ -580,11 +579,19 @@ int usb_driver_claim_interface(struct usb_driver
> *driver,
>         else
>                 pm_runtime_set_active(dev);
>
> -       /* if interface was already added, bind now; else let
> -        * the future device_add() bind it, bypassing probe()
> -        */
> -       if (device_is_registered(dev))
> +       if (device_is_registered(dev)) {
> +               dev->driver = &driver->driver;
>                 retval = device_bind_driver(dev);
> +       } else {
> +               /*
> +                * Interface not yet registered: record the claim without
> +                * setting dev->driver.  usb_set_configuration() will call
> +                * device_bind_driver() explicitly after device_add(),
> which
> +                * skips ->probe() and attaches knode_driver so teardown
> is safe.
> +                */
> +               iface->claimed = 1;
> +               iface->claimed_driver = driver;
> +       }
>
>         if (retval) {
>                 dev->driver = NULL;
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 75e2bfd74..73c630750 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -2269,8 +2269,23 @@ int usb_set_configuration(struct usb_device *dev,
> int configuration)
>                 if (ret != 0) {
>                         dev_err(&dev->dev, "device_add(%s) --> %d\n",
>                                 dev_name(&intf->dev), ret);
> +                       intf->claimed = 0;
> +                       intf->claimed_driver = NULL;
>                         continue;
>                 }
> +               if (intf->claimed) {
> +                       intf->dev.driver = &intf->claimed_driver->driver;
> +                       ret = device_bind_driver(&intf->dev);
> +                       if (ret) {
> +                               dev_err(&dev->dev,
> +                                       "device_bind_driver(%s) --> %d\n",
> +                                       dev_name(&intf->dev), ret);
> +                               intf->dev.driver = NULL;
> +                               intf->condition = USB_INTERFACE_UNBOUND;
> +                       }
> +                       intf->claimed = 0;
> +                       intf->claimed_driver = NULL;
> +               }
>                 create_intf_ep_devs(intf);
>         }
>
> diff --git a/include/linux/usb.h b/include/linux/usb.h
> index 1da4ad161..0ec743e76 100644
> --- a/include/linux/usb.h
> +++ b/include/linux/usb.h
> @@ -266,6 +266,8 @@ struct usb_interface {
>         unsigned needs_binding:1;       /* needs delayed unbind/rebind */
>         unsigned resetting_device:1;    /* true: bandwidth alloc after
> reset */
>         unsigned authorized:1;          /* used for interface
> authorization */
> +       unsigned claimed:1;             /* driver claimed before
> device_add() */
> +       struct usb_driver *claimed_driver;      /* driver for deferred
> bind */
>         enum usb_wireless_status wireless_status;
>         struct work_struct wireless_status_work;
> --
> 2.34.1
>