[PATCH 05/17] USB: Lock registered interfaces during manual driver binding
From: Leon Romanovsky
Date: Thu Nov 05 2026 - 06:45:49 EST
From: Leon Romanovsky <leonro@xxxxxxxxxx>
Interface claims hold the USB device lock, but device_bind_driver()
requires the target interface lock. Without it, trust-policy writes can
race admission.
Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
---
drivers/bluetooth/btusb_main.c | 42 ++++++++++++++++++++++++++++++------------
drivers/usb/core/driver.c | 25 ++++++++++++++++++++++++-
drivers/usb/core/message.c | 8 ++++++++
drivers/usb/core/usb.h | 2 ++
4 files changed, 64 insertions(+), 13 deletions(-)
diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7e60396..8fe6bd1bff906 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -2993,10 +2993,13 @@ static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
return hci_recv_frame(hdev, skb);
}
+/* usb_lock_device_for_reset() gives up after one second of contention */
+#define BTUSB_MTK_ISO_LOCK_TRIES 5
+
static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
{
struct btmtk_data *btmtk_data;
- int err;
+ int err, i;
if (!data->hdev)
return;
@@ -3011,22 +3014,37 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
}
/*
- * The function usb_driver_claim_interface() is documented to need
- * locks held if it's not called from a probe routine. The code here
- * is called from the hci_power_on workqueue, so grab the lock.
+ * Disconnect holds the device lock while draining this setup work, so
+ * the lock must be taken with disconnect-aware acquisition. Hold a PM
+ * reference so the device cannot suspend first. A slow interface
+ * registration can keep the lock past the one-second limit of a single
+ * attempt, so retry a few times, but not without bound: a teardown
+ * that holds the lock may be waiting for this work.
*/
- device_lock(&btmtk_data->isopkt_intf->dev);
- err = usb_driver_claim_interface(&btusb_driver,
- btmtk_data->isopkt_intf, data);
- device_unlock(&btmtk_data->isopkt_intf->dev);
+ err = usb_autopm_get_interface(data->intf);
+ if (!err) {
+ for (i = 0; i < BTUSB_MTK_ISO_LOCK_TRIES; i++) {
+ err = usb_lock_device_for_reset(data->udev, data->intf);
+ if (err != -EBUSY)
+ break;
+ }
+ if (!err) {
+ err = usb_driver_claim_interface(&btusb_driver,
+ btmtk_data->isopkt_intf,
+ data);
+ if (!err) {
+ init_usb_anchor(&btmtk_data->isopkt_anchor);
+ set_bit(BTMTK_ISOPKT_OVER_INTR,
+ &btmtk_data->flags);
+ }
+ usb_unlock_device(data->udev);
+ }
+ usb_autopm_put_interface(data->intf);
+ }
if (err < 0) {
btmtk_data->isopkt_intf = NULL;
bt_dev_err(data->hdev, "Failed to claim iso interface: %d", err);
- return;
}
-
- set_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags);
- init_usb_anchor(&btmtk_data->isopkt_anchor);
}
static void btusb_mtk_release_iso_intf(struct hci_dev *hdev)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index d3a61ebc6afb0..262502642ca98 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -584,8 +584,11 @@ int usb_driver_claim_interface(struct usb_driver *driver,
/* if interface was already added, bind now; else let
* the future device_add() bind it, bypassing probe()
*/
- if (device_is_registered(dev))
+ if (device_is_registered(dev)) {
+ device_lock(dev);
retval = device_bind_driver(dev);
+ device_unlock(dev);
+ }
if (retval) {
dev->driver = NULL;
@@ -649,6 +652,26 @@ void usb_driver_release_interface(struct usb_driver *driver,
}
EXPORT_SYMBOL_GPL(usb_driver_release_interface);
+/*
+ * The driver core refused to bind an interface that a sibling claimed before
+ * it was registered, and dropped the claim. Let the claimant release the
+ * interface instead of operating it with a bound interface but no driver.
+ */
+void usb_driver_release_refused_claim(struct usb_interface *iface,
+ struct device_driver *claimant)
+{
+ struct device *dev = &iface->dev;
+
+ device_lock(dev);
+ if (!dev->driver && iface->condition == USB_INTERFACE_BOUND) {
+ dev->driver = claimant;
+ usb_unbind_interface(dev);
+ dev_set_drvdata(dev, NULL);
+ dev->driver = NULL;
+ }
+ device_unlock(dev);
+}
+
/* returns 0 if no match, 1 if match */
int usb_match_device(struct usb_device *dev, const struct usb_device_id *id)
{
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a738d03c23eac..d35a7710c8ef4 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2264,6 +2264,7 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
*/
for (i = 0; i < nintf; ++i) {
struct usb_interface *intf = cp->interface[i];
+ struct device_driver *claimant;
if (intf->dev.of_node &&
!of_device_is_available(intf->dev.of_node)) {
@@ -2277,7 +2278,14 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
dev_name(&intf->dev), configuration,
intf->cur_altsetting->desc.bInterfaceNumber);
device_enable_async_suspend(&intf->dev);
+ claimant = intf->dev.driver;
+ if (claimant && !try_module_get(claimant->owner))
+ claimant = NULL;
ret = device_add(&intf->dev);
+ if (!ret && claimant && !intf->dev.driver)
+ usb_driver_release_refused_claim(intf, claimant);
+ if (claimant)
+ module_put(claimant->owner);
if (ret != 0) {
dev_err(&dev->dev, "device_add(%s) --> %d\n",
dev_name(&intf->dev), ret);
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index a9b37aeb515be..293340a48b6c5 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -49,6 +49,8 @@ extern int usb_set_isoch_delay(struct usb_device *dev);
extern int usb_get_bos_descriptor(struct usb_device *dev);
extern void usb_release_bos_descriptor(struct usb_device *dev);
extern int usb_set_configuration(struct usb_device *dev, int configuration);
+void usb_driver_release_refused_claim(struct usb_interface *iface,
+ struct device_driver *claimant);
extern int usb_choose_configuration(struct usb_device *udev);
extern int usb_generic_driver_probe(struct usb_device *udev);
extern void usb_generic_driver_disconnect(struct usb_device *udev);
--
2.56.0