usb_hub_configure_ports() queues one scan entry per port and leaves the draining to usb_device_list_scan(). That function is not reentrant: when a hub is found during a scan, its ports are queued and processed by the loop that is already running rather than by a nested one.
An entry therefore outlives the call that created it, and it holds pointers to both the usb_device and its usb_hub_device. Removing a hub frees the former in usb_free_device() and the latter in usb_hub_disconnect(), so any entry left in the list would be dereferenced after the free - hub->query_delay is read on every round. Drop the entries belonging to a device before it goes away. usb_remove_device() recurses into the children first, so every device in a removed subtree cleans up its own entries. Signed-off-by: Sascha Hauer <[email protected]> Assisted-by: Claude:claude-opus-5 --- drivers/usb/core/hub.c | 24 ++++++++++++++++++++++++ drivers/usb/core/usb.c | 3 +++ drivers/usb/core/usb.h | 1 + 3 files changed, 28 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 3820b4cc90..b56c658f91 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -260,6 +260,30 @@ static int hub_port_reset(struct usb_device *hub, int port, } +/** + * usb_hub_cancel_scans - drop pending port scans of a hub that goes away + * @dev: the USB device that is about to be removed + * + * The scan list is filled by usb_hub_configure_ports() and drained by + * usb_device_list_scan(). As the latter is not reentrant, a hub found + * during a scan queues its ports and leaves them for the loop that is + * already running. If that hub is removed before its entries have been + * processed, they would be left pointing at the freed usb_device and its + * freed usb_hub_device. + */ +void usb_hub_cancel_scans(struct usb_device *dev) +{ + struct usb_device_scan *usb_scan, *tmp; + + list_for_each_entry_safe(usb_scan, tmp, &usb_scan_list, list) { + if (usb_scan->dev != dev) + continue; + + list_del(&usb_scan->list); + free(usb_scan); + } +} + static void usb_hub_port_connect_change(struct usb_device *dev, int port, uint16_t portstatus, uint16_t portchange) { diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 3daa6b1d1d..bc80e66fcb 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -620,6 +620,9 @@ void usb_remove_device(struct usb_device *usbdev) for (i = 0; i < usbdev->maxchild; i++) usb_remove_device(usbdev->children[i]); + + usb_hub_cancel_scans(usbdev); + if (usbdev->parent && usbdev->portnr) usbdev->parent->children[usbdev->portnr - 1] = NULL; list_del(&usbdev->list); diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h index 0d4f80c21d..b3c224d88f 100644 --- a/drivers/usb/core/usb.h +++ b/drivers/usb/core/usb.h @@ -6,5 +6,6 @@ struct usb_device *usb_alloc_new_device(void); void usb_free_device(struct usb_device *dev); int usb_new_device(struct usb_device *dev); void usb_remove_device(struct usb_device *dev); +void usb_hub_cancel_scans(struct usb_device *dev); #endif /* __CORE_USB_H */ -- 2.47.3
