From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f199.google.com (mail-oi1-f199.google.com [209.85.167.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98C8530C158 for ; Tue, 11 Aug 2026 04:49:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786423753; cv=none; b=sXwwaDey2i+9JJxY7V6AdylZ/lew76dRk92Js1vCk4p5GMHdHB4kX6BoT/3uvhj3Mg3iRU17d26Q4wrydCQhUA7vdD1npFYF6p7iCniU8hMlnU5UrF9uV5LC6las+giOTScDM/d1TEiD8mjLoTT6Pf7SKQIrIUdTiTSJ+gEF0E4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786423753; c=relaxed/simple; bh=+o0QZbHq8shh0QZkez9Wh48oF6Ro11ss0BV4/PlkeAw=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=bZuJLNwXg7i643R6pSnk3b/JvBTn7NhOETtMIDQTv533Sf1O7oRZOBB8y9pJrN1vthoZs5vPbeUnnItUAIMon4PLK8Hfp3CFYF7aDjHwe0pkgYeOd9B37kS9puM3bOKUpE2xlSXRJcTHV+qvjsssc3a4gMKm8vptV+63+m5tH54= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f199.google.com with SMTP id 5614622812f47-495f637105eso566317b6e.2 for ; Mon, 10 Aug 2026 21:49:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786423750; x=1787028550; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=wPzxXWfVe/XeAnwACoFJ1eH1e1cA8LkZX5I2xfZs+as=; b=GtRBmsWrDn7UWXKwhkWkcp+ZHt/U1rEdKduDv21SmgVm3NKaBi3AlqjQocfgBe9sco asauCF96B3fbtKD0fa22gMoRJ1bFCBRrBn82fXevE8jLNf25lnnn5TD5kvZeWFk7B3Xb dysiqbpiCUZYCyqV3LmhQojStFYogcHjrDOKEGBIhaY8w10bCvzY6UDMg2uCb4Fzb5ta 5If0R4EVGR4afjqOc9DJKWJbeZgwJQRXMmgUxuzehb0GlskkIpGiF2qSXmeM65cM2/0y 07iq6EYKLM59RjSs1OnwdM5TGmyi3FOKNxu8WFxiLf1jfUsuGTt9FoXC2HdJXsf5/RBT 1uRQ== X-Gm-Message-State: AOJu0YxjRYe3Wol5ymCm3hmtiQLeO6gs+jQgdKFXx3OkWN9xW2agFRdL Zl/KeSY4dIIsdlkG0Aq41Sostl4kSkhc/VJiGetL4AzXe2o4BbkTvey1NHZ7m53+Ehg/KAGvwP5 gbD9qfDECJHVTgT52/XpyxoWWd3dwJ0Vs1AqXiAUfOkngMw0dxMz+L0BrnyY= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:4f0b:b0:489:352c:5153 with SMTP id 5614622812f47-4b1fd9491a7mr451802b6e.21.1786423750513; Mon, 10 Aug 2026 21:49:10 -0700 (PDT) Date: Mon, 10 Aug 2026 21:49:10 -0700 In-Reply-To: <6a78d160.01d0871a.3a0d52.0090.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a7aa9c6.01d0871a.3a0d52.00bd.GAE@google.com> Subject: Forwarded: Re: WARNING: refcount bug in trace_suspend_resume (2) From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Re: WARNING: refcount bug in trace_suspend_resume (2) Author: khiemtranzo532001@gmail.com #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next >From dc76c5bf35d3e11a56c1402294d11297165fec21 Mon Sep 17 00:00:00 2001 From: Nguyen Quang Le Kien Date: Tue, 11 Aug 2026 12:46:21 +0800 Subject: [PATCH] usb: gadget: fix refcount race in gadget_dev_open() gadget_dev_open() accesses dev->lock and calls get_dev() without holding sb_mutex, which is held by gadgetfs_kill_sb() when it calls put_dev(the_device) and frees the device. This creates a race where open() reads dev->lock after kill_sb() has already freed the dev_data object, resulting in a refcount underflow and use-after-free. Fix by wrapping gadget_dev_open() with scoped_guard(mutex, &sb_mutex) to serialise against gadgetfs_kill_sb(), and check the_device inside the guard before dereferencing dev. Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445 Signed-off-by: Nguyen Quang Le Kien --- drivers/usb/gadget/legacy/inode.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index d87a8ab51..719ea5c18 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1916,15 +1916,19 @@ gadget_dev_open (struct inode *inode, struct file *fd) struct dev_data *dev = inode->i_private; int value = -EBUSY; - spin_lock_irq(&dev->lock); - if (dev->state == STATE_DEV_DISABLED) { - dev->ev_next = 0; - dev->state = STATE_DEV_OPENED; - fd->private_data = dev; - get_dev (dev); - value = 0; + scoped_guard(mutex, &sb_mutex) { + if (!the_device) + return -ENODEV; + spin_lock_irq(&dev->lock); + if (dev->state == STATE_DEV_DISABLED) { + dev->ev_next = 0; + dev->state = STATE_DEV_OPENED; + fd->private_data = dev; + get_dev (dev); + value = 0; + } + spin_unlock_irq(&dev->lock); } - spin_unlock_irq(&dev->lock); return value; } -- 2.34.1