Re: [PATCH v4] driver core: avoid klist_remove() on unattached knode_driver

[Nguyen Quang Le Kien]

On Tue, Aug 26, 2026 at 09:14:00PM +0000, Danilo Krummrich wrote:
  > So, for a fix that also goes into stable trees what you propose sounds
  > reasonable, but eventually we should use the match() infrastructure instead.

  I've implemented the approach you described:

    - In usb_driver_claim_interface(), when !device_is_registered(dev),
      skip setting dev->driver. Instead set two new fields on struct
      usb_interface: claimed:1 and claimed_driver.

    - In usb_set_configuration(), after device_add() succeeds, check
      intf->claimed and call device_bind_driver() explicitly. This skips
      ->probe() and attaches knode_driver to the driver's
      klist, making teardown safe.

    - The __device_attach() dev->driver path in dd.c is left untouched
      for w1 / ccwgroup / pata_parport.

  syzbot confirmed the fix; the reproducer no longer triggers:

    Tested-by: syzbot+87188222c77c0dbbdb4d@xxxxxxxxxxxxxxxxxxxxxxxxx
    Patch:      https://syzkaller.appspot.com/x/patch.diff?x=12af8b49580000
    Dashboard:  https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d

  Will send v5 shortly with the syzbot Tested-by added and the subject
  retitled to "usb: core: ..." since the change is scoped to USB only.

  Could I get a Reviewed-by from you?

  Thanks,
  Kiennql