Re: [PATCH v4] driver core: avoid klist_remove() on unattached knode_driver

On Thu, Aug 20, 2026 at 04:45:57PM +0800, Nguyen Quang Le Kien wrote:
> usb_driver_claim_interface() sets dev->driver directly and skips
> device_bind_driver() when the interface is not yet registered, so the
> device can reach teardown with dev->driver set but knode_driver never
> added to the driver's klist_devices. __device_release_driver() then
> unconditionally calls klist_remove() on the unattached node, which
> dereferences a NULL klist pointer in klist_put() and crashes.
> 
> Only remove the node if the device is actually bound. Use
> device_is_bound() rather than klist_node_attached() directly: the
> latter is a raw klist API and does not NULL-check dev->p, while
> device_is_bound() is the standard bound-state check used throughout
> driver core (driver_bound(), __device_attach()).
> 
> Fixes: 94e7b1c5ff20 ("[PATCH] Add a klist to struct device_driver for the devices bound to it.")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=87188222c77c0dbbdb4d
> Cc: [email protected]
> Signed-off-by: Nguyen Quang Le Kien <[email protected]>
> ---
> Changes in v4:
> - add a changelog below the --- line, as required by submitting-patches.rst
> - add Cc: [email protected], Fixes: points to a released kernel

Please slow down.  As my bot said, there is no rush, no deadline, and
it's the middle of the merge window and we can't even do anything with
this anyway.

At the least, wait a week between patch revisions.  If you wish to see
patches reviewed faster, then help out with actual reviews of patches
from others.  Constantly resending stuff like this doesn't make anyone
want to review this at all.

thanks,

greg k-h