[PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[Eklavya Singh]

gadgetfs_bind() takes its reference on dev_data only right before it
returns success, but its error path calls gadgetfs_unbind(), which
always calls put_dev(). So when bind fails it drops a reference it
never took.

With ep0 open the count is 2, one for the superblock and one for the
open file. A failed bind takes it to 1, closing ep0 frees dev_data,
and the superblock still points at it. The next open of ep0 then takes
dev->lock on freed memory:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
   gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919

syzbot gets there by making an allocation in bind fail, which is the
"failed to start USB Gadget filesystem: -12" message right before the
report.

Take the reference before anything in bind can fail, so that
gadgetfs_unbind() always has one to drop.

I tested this on dummy_hcd by writing a config to ep0 with fail-nth
set and then closing and reopening ep0, for every fail-nth value the
write goes through. Without the patch KASAN reports the use-after-free
right after the first failed bind. With it, 122 failed binds give no
reports and the last bind works.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+1459655b2bf1e798f9d0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
Cc: stable@vger.kernel.org
Signed-off-by: Eklavya Singh <eklavyasingh2106@gmail.com>
---
 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 67c6ffaf4..f5b97dcd4 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1688,6 +1688,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 		return -ENODEV;
 	}
 
+	get_dev(dev);
 	set_gadget_data (gadget, dev);
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
@@ -1706,7 +1707,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:
-- 
2.55.0

Re: [PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[sashiko-bot]

> gadgetfs_bind() takes its reference on dev_data only right before it
> returns success, but its error path calls gadgetfs_unbind(), which
> always calls put_dev(). So when bind fails it drops a reference it
> never took.
> 
> With ep0 open the count is 2, one for the superblock and one for the
> open file. A failed bind takes it to 1, closing ep0 frees dev_data,
> and the superblock still points at it. The next open of ep0 then takes
> dev->lock on freed memory:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
>    gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919
> 
> syzbot gets there by making an allocation in bind fail, which is the
> "failed to start USB Gadget filesystem: -12" message right before the
> [ ... ]
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+1459655b2bf1e798f9d0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
> Cc: stable@vger.kernel.org
> Signed-off-by: Eklavya Singh <eklavyasingh2106@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018163434.129569-1-eklavyasingh2106@gmail.com?part=1

Re: [PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[Greg Kroah-Hartman]

On Sun, Oct 18, 2026 at 04:34:34PM +0000, Eklavya Singh wrote:
> gadgetfs_bind() takes its reference on dev_data only right before it
> returns success, but its error path calls gadgetfs_unbind(), which
> always calls put_dev(). So when bind fails it drops a reference it
> never took.
> 
> With ep0 open the count is 2, one for the superblock and one for the
> open file. A failed bind takes it to 1, closing ep0 frees dev_data,
> and the superblock still points at it. The next open of ep0 then takes
> dev->lock on freed memory:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
>    gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919
> 
> syzbot gets there by making an allocation in bind fail, which is the
> "failed to start USB Gadget filesystem: -12" message right before the
> report.
> 
> Take the reference before anything in bind can fail, so that
> gadgetfs_unbind() always has one to drop.
> 
> I tested this on dummy_hcd by writing a config to ep0 with fail-nth
> set and then closing and reopening ep0, for every fail-nth value the
> write goes through. Without the patch KASAN reports the use-after-free
> right after the first failed bind. With it, 122 failed binds give no
> reports and the last bind works.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+1459655b2bf1e798f9d0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
> Cc: stable@vger.kernel.org
> Signed-off-by: Eklavya Singh <eklavyasingh2106@gmail.com>
> ---
>  drivers/usb/gadget/legacy/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index 67c6ffaf4..f5b97dcd4 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -1688,6 +1688,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  		return -ENODEV;
>  	}
>  
> +	get_dev(dev);
>  	set_gadget_data (gadget, dev);
>  	dev->gadget = gadget;
>  	gadget->ep0->driver_data = dev;
> @@ -1706,7 +1707,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  	spin_lock_irq(&dev->lock);
>  	dev->state = STATE_DEV_UNCONNECTED;
>  	spin_unlock_irq(&dev->lock);
> -	get_dev (dev);
>  	return 0;
>  
>  enomem:
> -- 
> 2.55.0
> 

Isn't this already fixed in the usb-next tree?

thanks,

greg k-h