[PATCH 07/13] usb: hub: cancel pending port scans of a removed device

[Sascha Hauer <s.hauer@pengutronix.de>]

usb_hub_configure_ports() queues one scan entry per port and leaves the
draining to usb_device_list_scan(). That function is not reentrant: when
a hub is found during a scan, its ports are queued and processed by the
loop that is already running rather than by a nested one.

An entry therefore outlives the call that created it, and it holds
pointers to both the usb_device and its usb_hub_device. Removing a hub
frees the former in usb_free_device() and the latter in
usb_hub_disconnect(), so any entry left in the list would be dereferenced
after the free - hub->query_delay is read on every round.

Drop the entries belonging to a device before it goes away.
usb_remove_device() recurses into the children first, so every device in
a removed subtree cleans up its own entries.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Assisted-by: Claude:claude-opus-5
---
 drivers/usb/core/hub.c | 24 ++++++++++++++++++++++++
 drivers/usb/core/usb.c |  3 +++
 drivers/usb/core/usb.h |  1 +
 3 files changed, 28 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 3820b4cc90..b56c658f91 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -260,6 +260,30 @@ static int hub_port_reset(struct usb_device *hub, int port,
 }
 
 
+/**
+ * usb_hub_cancel_scans - drop pending port scans of a hub that goes away
+ * @dev: the USB device that is about to be removed
+ *
+ * The scan list is filled by usb_hub_configure_ports() and drained by
+ * usb_device_list_scan(). As the latter is not reentrant, a hub found
+ * during a scan queues its ports and leaves them for the loop that is
+ * already running. If that hub is removed before its entries have been
+ * processed, they would be left pointing at the freed usb_device and its
+ * freed usb_hub_device.
+ */
+void usb_hub_cancel_scans(struct usb_device *dev)
+{
+	struct usb_device_scan *usb_scan, *tmp;
+
+	list_for_each_entry_safe(usb_scan, tmp, &usb_scan_list, list) {
+		if (usb_scan->dev != dev)
+			continue;
+
+		list_del(&usb_scan->list);
+		free(usb_scan);
+	}
+}
+
 static void usb_hub_port_connect_change(struct usb_device *dev, int port,
 					uint16_t portstatus, uint16_t portchange)
 {
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 3daa6b1d1d..bc80e66fcb 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -620,6 +620,9 @@ void usb_remove_device(struct usb_device *usbdev)
 
 	for (i = 0; i < usbdev->maxchild; i++)
 		usb_remove_device(usbdev->children[i]);
+
+	usb_hub_cancel_scans(usbdev);
+
 	if (usbdev->parent && usbdev->portnr)
 		usbdev->parent->children[usbdev->portnr - 1] = NULL;
 	list_del(&usbdev->list);
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 0d4f80c21d..b3c224d88f 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -6,5 +6,6 @@ struct usb_device *usb_alloc_new_device(void);
 void usb_free_device(struct usb_device *dev);
 int usb_new_device(struct usb_device *dev);
 void usb_remove_device(struct usb_device *dev);
+void usb_hub_cancel_scans(struct usb_device *dev);
 
 #endif /* __CORE_USB_H */

-- 
2.47.3