Re: [PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[sashiko-bot@kernel.org]

> gadgetfs_bind() takes its reference on dev_data only right before it
> returns success, but its error path calls gadgetfs_unbind(), which
> always calls put_dev(). So when bind fails it drops a reference it
> never took.
> 
> With ep0 open the count is 2, one for the superblock and one for the
> open file. A failed bind takes it to 1, closing ep0 frees dev_data,
> and the superblock still points at it. The next open of ep0 then takes
> dev->lock on freed memory:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
>    gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919
> 
> syzbot gets there by making an allocation in bind fail, which is the
> "failed to start USB Gadget filesystem: -12" message right before the
> [ ... ]
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+1459655b2bf1e798f9d0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
> Cc: stable@vger.kernel.org
> Signed-off-by: Eklavya Singh <eklavyasingh2106@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018163434.129569-1-eklavyasingh2106@gmail.com?part=1