On Wed, Aug 26, 2026 at 05:35:49PM +0200, Michal Pecio wrote: > On Wed, 26 Aug 2026 16:25:42 +0200, Greg Kroah-Hartman wrote: > > > I think you confused 'bind' / 'unbind' with the likes of 'new_id' > > > and 'driver_override'. Try binding xhci_hcd to NVMe, you won't get > > > far. > > > > It seems to result in a failure report that people keep sending random > > patches for :( > > It results in write() returning -ENODEV. > > You can't bind random drivers to random devices out of the box, > you need ID overrides. And then you don't need to bind manually, > the kernel will happily select the wrong driver by default. > > Authors of the recent xhci and thunderbolt patches admitted that > 'driver_override' was involved in both cases.
I'll be glad to taint if driver_override is also written to, but it's bind() that triggers the actual action happening. Or so the traces show. > Meanwhile, Syzbot also found a stupid write to freed memory in USB > core when HCs are unbound. You may say it doesn't matter, but: > > * USB HCs are hotpluggable thunderbolt "gadgets" these days We support PCI devices being removed, but that falls under the PCI hotplug rules/requirements, right? Anyway, sure, we can fix those bugs when found, but that's not the majority of what we are seeing at the moment. Look at all of the dumb platform drivers that are getting hit with this on the syzbot reports... > * there were plans to alter this code so that UAF is triggered by > hot removal of the USB device, not its parent HC I don't understand what you mean by this. > IMO the actually meaningful change would be to taint driver ID > overrides, because that's the known risky and crash-prone madness. > bind/unbind taint is noise that will be ignored. it's not going to be ignored if panic_on_taint is enabled in syzbot, which the authors have said they will do :) thanks, greg k-h
