usb_driver_claim_interface() may claim an interface that is not yet registered, in which case it only sets dev->driver and relies on the later device_add() to bind it via __device_attach(). With the bus drivers_autoprobe disabled, device_initial_probe() skips the attach, so the device is registered with dev->driver set but never added to the driver's klist. Releasing such a device (from usb_driver_release_interface() or from sysfs unbind) makes __device_release_driver() call klist_remove() on an unattached node and dereference a NULL klist: KASAN: null-ptr-deref in range [0x58-0x5f] RIP: klist_put+0x4d/0x1d0 klist_remove+0x14c/0x2e0 device_release_driver_internal+0x4fb/0x620 usb_driver_release_interface+0x10e/0x190 cdc_ncm_unbind+0x2ac/0x350 usbnet_disconnect+0x1e2/0x300 usb_unbind_interface+0x1dd/0x9e0 Autoprobe only governs matching drivers to devices; a device that already has a driver needs no matching, just the bind that was promised at claim time. Do that bind under the device lock when autoprobe is off, so that a concurrently cleared dev->driver cannot fall through to probing every driver on the bus. Reported-by: syzbot+863936f50214e843ae0c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=863936f50214e843ae0c Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Nguyen Ngoc Thang --- v3: Sashiko noted that the lockless dev->driver check in v2 could race with dev->driver being cleared, letting __device_attach() probe every driver despite autoprobe being off. Do the preset bind in a helper that checks dev->driver under the device lock. v2: fix the unbound state itself rather than usb_driver_release_interface() (a sysfs unbind would still hit it). Tested with the syzbot C reproducer in QEMU (KASAN, dummy_hcd). The race that leaves the interface unbound is rare, so to make it deterministic I temporarily made device_initial_probe() behave as if autoprobe were off whenever dev->driver is set: the unpatched logic oopses 3/3, with this patch 0/4 (64 USB connects each). The plain patched kernel shows no oops either. drivers/base/dd.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 137bf1dea333..bb1e76bf6122 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -1142,6 +1142,16 @@ int device_attach(struct device *dev) } EXPORT_SYMBOL_GPL(device_attach); +/* Bind a device whose driver was set before device_add(), no matching. */ +static void device_bind_preset(struct device *dev) +{ + device_lock(dev); + if (!dev->p->dead && dev->driver && !device_is_bound(dev) && + device_bind_driver(dev)) + device_set_driver(dev, NULL); + device_unlock(dev); +} + void device_initial_probe(struct device *dev) { struct subsys_private *sp = bus_to_subsys(dev->bus); @@ -1149,9 +1159,10 @@ void device_initial_probe(struct device *dev) if (!sp) return; - /* a device with a preset driver must still be bound */ - if (sp->drivers_autoprobe || dev->driver) + if (sp->drivers_autoprobe) __device_attach(dev, true); + else + device_bind_preset(dev); subsys_put(sp); } -- 2.43.0