USB: core: document purpose of interface parent reference

PATCH In review Johan Hovold 4 participants 10 messages Oct 15 – Oct 17 USB

lore

Share & tools

lore

Johan Hovold

author

2026-10-15 07:50 UTC #0 lore raw

PATCH 1/1 USB: core: document purpose of interface parent reference

USB interfaces hold a reference to their parent USB device to make sure they do not outlive the parent.

Add a comment explaining that this reference is specifically needed for asynchronous device resets and the device type need_parent_lock feature (to allow driver core to lock the parent when only holding a reference to the interface).

See commits:

524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")

for further details.

Signed-off-by Johan Hovold <[email protected]>

---
 drivers/usb/core/message.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/usb/core/message.c +5 -0

index 276768f47558..a738d03c23ea 100644
@@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		pm_runtime_no_callbacks(&intf->dev);
 		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
 				dev->devpath, configuration, ifnum);
+		/*
+		 * Make sure the interface does not outlive its parent (e.g.
+		 * as needed for usb_queue_reset_device() and
+		 * usb_if_device_type->need_parent_lock).
+		 */
 		usb_get_dev(dev);
 	}
 	kfree(new_interfaces);

Signature · 1 line

2.55.0

[email protected]

AI review

2026-10-15 07:59 UTC #1 lore raw

Sashiko has reviewed this patch and found no issues. It looks great!

Quoted 8 lines

USB interfaces hold a reference to their parent USB device to make sure they do not outlive the parent.
Add a comment explaining that this reference is specifically needed for asynchronous device resets and the device type need_parent_lock feature (to allow driver core to lock the parent when only holding a reference to the interface).

Quoted 8 lines

See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
Signed-off-by Johan Hovold <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Danilo Krummrich

Reviewed-by on v1 1/1

2026-10-15 08:08 UTC #2 lore raw

In reply to Johan Hovold

Quoted 8 lines · Johan Hovold

USB interfaces hold a reference to their parent USB device to make sure they do not outlive the parent.
Add a comment explaining that this reference is specifically needed for asynchronous device resets and the device type need_parent_lock feature (to allow driver core to lock the parent when only holding a reference to the interface).

Quoted 8 lines

See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
Signed-off-by Johan Hovold <[email protected]>

NIT: Maybe add that the reference count must be held until release().

In any case,

Reviewed-by Danilo Krummrich <[email protected]>

Quoted 22 lines

---
 drivers/usb/core/message.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/usb/core/message.c +5 -0

index 276768f47558..a738d03c23ea 100644
@@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		pm_runtime_no_callbacks(&intf->dev);
 		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
 				dev->devpath, configuration, ifnum);
+		/*
+		 * Make sure the interface does not outlive its parent (e.g.
+		 * as needed for usb_queue_reset_device() and
+		 * usb_if_device_type->need_parent_lock).
+		 */
 		usb_get_dev(dev);
 	}
 	kfree(new_interfaces);

Signature · 1 line

2.55.0

Johan Hovold

author

2026-10-15 08:28 UTC #3 lore raw

Quoted 11 lines · Danilo Krummrich

Quoted 10 lines · Johan Hovold
USB interfaces hold a reference to their parent USB device to make sure they do not outlive the parent.
Add a comment explaining that this reference is specifically needed for asynchronous device resets and the device type need_parent_lock feature (to allow driver core to lock the parent when only holding a reference to the interface).
See commits:

Quoted 8 lines

Quoted 6 lines
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
Signed-off-by Johan Hovold <[email protected]>
NIT: Maybe add that the reference count must be held until release().

I think that's implied as the comment refers to the lifetime of these objects.

Quoted 3 lines

In any case,
Reviewed-by Danilo Krummrich <[email protected]>

Thanks for reviewing.

Quoted 11 lines

drivers/usb/core/message.c int usb_set_configuration(struct usb_device *dev, int configuration) · line 2218

Quoted 11 lines

drivers/usb/core/message.c +5 -0

@@ -2209,6 +2209,11 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		pm_runtime_no_callbacks(&intf->dev);
 		dev_set_name(&intf->dev, "%d-%s:%d.%d", dev->bus->busnum,
 				dev->devpath, configuration, ifnum);
+		/*
+		 * Make sure the interface does not outlive its parent (e.g.
+		 * as needed for usb_queue_reset_device() and
+		 * usb_if_device_type->need_parent_lock).
+		 */
 		usb_get_dev(dev);
 	}

Johan

Danilo Krummrich

2026-10-16 20:54 UTC #4 lore raw

In reply to Johan Hovold

Quoted 6 lines · Johan Hovold

See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.

The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.

Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.

Thanks,
Danilo

Greg Kroah-Hartman

maintainer

2026-10-17 08:18 UTC #5 lore raw

Quoted 6 lines · Danilo Krummrich

Quoted 5 lines · Johan Hovold
See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")

Quoted 7 lines

Quoted 1 line
for further details.
The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.
Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.

I just grabbed it now, thanks.

greg k-h

Johan Hovold

author

2026-10-17 08:28 UTC #6 lore raw

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines · Danilo Krummrich
Quoted 6 lines · Johan Hovold
See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.

Quoted 7 lines

Quoted 5 lines
The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.
Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.
I just grabbed it now, thanks.

I should have waited a bit with posting this one.

The commit id mentioned in the commit message above was changed when the driver core commit was moved from driver-core-testing to the driver-core-linus branch. I guess we can always find it via the patch link (or commit summary).

Johan

Greg Kroah-Hartman

maintainer

2026-10-17 08:50 UTC #7 lore raw

Quoted 16 lines · Johan Hovold

Quoted 15 lines · Greg Kroah-Hartman
Quoted 13 lines · Danilo Krummrich
Quoted 6 lines · Johan Hovold
See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.
Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.

Quoted 8 lines

Quoted 1 line
I just grabbed it now, thanks.
I should have waited a bit with posting this one.
The commit id mentioned in the commit message above was changed when the driver core commit was moved from driver-core-testing to the driver-core-linus branch. I guess we can always find it via the patch link (or commit summary).

I can still edit this as it's not really lived long in my branch, what should the text be here?

thanks,

greg k-h

Johan Hovold

author

2026-10-17 08:57 UTC #8 lore raw

Quoted 21 lines · Greg Kroah-Hartman

Quoted 20 lines · Johan Hovold
Quoted 9 lines · Greg Kroah-Hartman
Quoted 8 lines · Danilo Krummrich
Quoted 6 lines · Johan Hovold
See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
Quoted 7 lines
Quoted 5 lines
The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.
Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.
I just grabbed it now, thanks.
I should have waited a bit with posting this one.

Quoted 7 lines

Quoted 4 lines
The commit id mentioned in the commit message above was changed when the driver core commit was moved from driver-core-testing to the driver-core-linus branch. I guess we can always find it via the patch link (or commit summary).
I can still edit this as it's not really lived long in my branch, what should the text be here?

The second reference should be:

0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect")

Thanks!

Johan

Greg Kroah-Hartman

maintainer

2026-10-17 10:41 UTC #9 lore raw

Quoted 27 lines · Johan Hovold

Quoted 26 lines · Greg Kroah-Hartman
Quoted 24 lines · Johan Hovold
Quoted 9 lines · Greg Kroah-Hartman
Quoted 8 lines · Danilo Krummrich
Quoted 6 lines · Johan Hovold
See commits:
524134d42231 ("USB: don't cancel queued resets when unbinding drivers") af61396a992b ("driver core: fix parent lock use-after-free on USB disconnect")
for further details.
Quoted 7 lines
Quoted 5 lines
The last one is now 0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect"), and queued for a -fixes PR mid merge window.
Greg, please let me know if you want me to include this one, or if you will take it after -rc1 ist out.
I just grabbed it now, thanks.
I should have waited a bit with posting this one.
The commit id mentioned in the commit message above was changed when the driver core commit was moved from driver-core-testing to the driver-core-linus branch. I guess we can always find it via the patch link (or commit summary).

Quoted 6 lines

Quoted 2 lines
I can still edit this as it's not really lived long in my branch, what should the text be here?
The second reference should be:
0f554506a3fc ("driver core: fix parent lock use-after-free on USB disconnect")

Now fixed up, thanks.

greg k-h