Messages in this thread Patch in this message |  | | From | Ginger <> | | Date | Tue, 28 Apr 2026 12:54:22 +0800 | | Subject | [PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata() |
| |
In yurex_disconnect(), usb_set_intfdata(interface, NULL) was called before usb_deregister_dev(interface, &yurex_class). This opens a race window with usb_open() in the USB core:
T0 (yurex_disconnect) T1 (usb_open) -------------------------- ------------------------- usb_set_intfdata(iface, NULL) [t0] fops = usb_minors[minor] [t1] /* fops still valid here */ usb_deregister_dev() usb_minors[minor] = NULL [t2] file->f_op->open(inode, file) yurex_open() dev = usb_get_intfdata() [t3] /* dev is NULL */
Because t0 precedes t1 precedes t2 precedes t3, T1 can obtain the file_operations pointer for the device (t1, while the minor is still registered), then continue into yurex_open() where it calls usb_get_intfdata() and gets NULL back, leading to a NULL dereference.
Fix the race by calling usb_deregister_dev() first, which removes the device from usb_minors[] before the interface data pointer is cleared. Concurrent usb_open() that arrives after usb_deregister_dev() returns will fail to look up the fops and will never reach yurex_open().
Reported-by: Ginger <ginger.jzllee@gmail.com> Closes: https://lore.kernel.org/linux-usb/2026042718-unwieldy-dicing-626f@gregkh Signed-off-by: Ginger <ginger.jzllee@gmail.com> --- drivers/usb/misc/yurex.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c index 6d03e689850a..b5484ab77e91 100644 --- a/drivers/usb/misc/yurex.c +++ b/drivers/usb/misc/yurex.c @@ -310,11 +310,12 @@ static void yurex_disconnect(struct usb_interface *interface) int minor = interface->minor;
dev = usb_get_intfdata(interface); - usb_set_intfdata(interface, NULL);
/* give back our minor */ usb_deregister_dev(interface, &yurex_class);
+ usb_set_intfdata(interface, NULL); + /* prevent more I/O from starting */ usb_poison_urb(dev->urb); usb_poison_urb(dev->cntl_urb); -- 2.39.5
|  |