Re: [PATCH] usb: misc: yurex: fix ordering of usb_deregister_dev() and usb_set_intfdata()

[Oliver Neukum]

On 28.05.26 10:27, Junzhe Li wrote:
> In yurex_disconnect(), usb_set_intfdata(interface, NULL) was called
> before usb_deregister_dev(interface, &yurex_class).
> This opens a race window with usb_open() in the USB core:
>
>    T0 (yurex_disconnect)               T1 (usb_open)
>    --------------------------           -------------------------
>    usb_set_intfdata(iface, NULL) [t0]
>                                         fops = usb_minors[minor]  [t1]
>                                         /* fops still valid here */
>    usb_deregister_dev()
>      usb_minors[minor] = NULL   [t2]
>                                         file->f_op->open(inode, file)
>                                           yurex_open()
>                                             dev = usb_get_intfdata() [t3]
>                                             /* dev is NULL! */

Yes, but yurex_open() checks for dev == NULL
Could you please elaborate?

	Regards
		Oliver