lkml.org 
[lkml]   [2026]   [Apr]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
Subject[PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata()
In yurex_disconnect(), usb_set_intfdata(interface, NULL) was called
before usb_deregister_dev(interface, &yurex_class). This opens a race
window with usb_open() in the USB core:

T0 (yurex_disconnect) T1 (usb_open)
-------------------------- -------------------------
usb_set_intfdata(iface, NULL) [t0]
fops = usb_minors[minor] [t1]
/* fops still valid here */
usb_deregister_dev()
usb_minors[minor] = NULL [t2]
file->f_op->open(inode, file)
yurex_open()
dev = usb_get_intfdata() [t3]
/* dev is NULL */

Because t0 precedes t1 precedes t2 precedes t3, T1 can obtain the
file_operations pointer for the device (t1, while the minor is still
registered), then continue into yurex_open() where it calls
usb_get_intfdata() and gets NULL back, leading to a NULL dereference.

Fix the race by calling usb_deregister_dev() first, which removes the
device from usb_minors[] before the interface data pointer is cleared.
Concurrent usb_open() that arrives after usb_deregister_dev() returns
will fail to look up the fops and will never reach yurex_open().

Reported-by: Ginger <ginger.jzllee@gmail.com>
Closes: https://lore.kernel.org/linux-usb/2026042718-unwieldy-dicing-626f@gregkh
Signed-off-by: Ginger <ginger.jzllee@gmail.com>
---
drivers/usb/misc/yurex.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 6d03e689850a..b5484ab77e91 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -310,11 +310,12 @@ static void yurex_disconnect(struct
usb_interface *interface)
int minor = interface->minor;

dev = usb_get_intfdata(interface);
- usb_set_intfdata(interface, NULL);

/* give back our minor */
usb_deregister_dev(interface, &yurex_class);

+ usb_set_intfdata(interface, NULL);
+
/* prevent more I/O from starting */
usb_poison_urb(dev->urb);
usb_poison_urb(dev->cntl_urb);
--
2.39.5
\
 
 \ /
  Last update: 2026-04-28 06:55    [W:0.087 / U:20.774 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog