From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-245.mail.qq.com (out203-205-221-245.mail.qq.com [203.205.221.245]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B79371925BC for ; Mon, 10 Aug 2026 04:34:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.245 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786336456; cv=none; b=j9SrQ3NAeFUUfXTSdozS0uq9VfMifPTD+FcAuTETBzUaLNxcTV0jMkUltlz07KHX15ehvn2eXLQMS9Vmr/B79VLVbQyM5X+ezsWLbUBOPUUAujsuPRCnZQnkF9WwkBTSk/nQlBBW0g40nw4/oc2I60wtzwKyxbLLZm/ZhxJCflw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786336456; c=relaxed/simple; bh=4j7AWU/X5exlIjDP65v60baoopNyBWKkl96x6R75is8=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=GeHH0JMK+VK/atlamOH4QAFoddTO7cQvlKw4fDUi+WJQdPARu6JxhTcZMvpKlRu9bhKWFM0NgY701g9lqmM86WY67s9AhS7gmch52xYRAj86Sh/lRhrTKszDxGINbtzqiEi513nyujrueYpOq4+gvXzkowwo6OKatCNOakKhVBE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=ErfeKR/K; arc=none smtp.client-ip=203.205.221.245 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="ErfeKR/K" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786336439; bh=3kcZ68Gy+Zo/ajXxMwwZT0i+BMz3wQxcISeQTgBQLsg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ErfeKR/KEFq7XYferx3GjzXNcdZnUejXfYD4vBQ6XbXNfMBPcRme2ujpuMYBhRK30 mIHaDuPfs+M5r2EofbUMhohEGV67Bu096If80zM4kcbYR70GVCciRb7hUN3wsOngdl jskDNwInhDOoRK0LZGPGj7mDD5dyiCgDxqR/kwPg= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc50-0.qq.com (NewEsmtp) with SMTP id 87930CA1; Mon, 10 Aug 2026 12:33:57 +0800 X-QQ-mid: xmsmtpt1786336437tzgnn8lhn Message-ID: X-QQ-XMAILINFO: MmpliBmRb3iCcDgIDkBhSzyV9flXrtXGNUDcoCbGud4AzxXQJVSBM3sk2BsRQm rmrkedVh6n9eBe85x8VggYtrEsnLU9NwqvkkWickYgYl61wOk3akC45QfnHUnYj4mJlUa+oP3/gt VsKrku6dCcUm0SAXEm2PDq9MIj/weyASYnhAn4VdELuffdMsgP1ScwAJL4VJ4OsB40PQFxk/TQwh dcWs04MVwANzMsNVcMkCBRFOZ3kgyT2hli6gXDA/EfMJlEjeAGS74avE5evQy5htW7zSfCEJfYg2 mLSKggaDe+Zr+7gKNTQlM/iXSU0FTNFmfTfubgAyjIIlLmpJwn2hE3rjMpDU9YQfAvvEvNGkrW9X XQgp4CyfxeUCGZ2XPuP8PmdFhW5JHIncy4lDnLrzEMC9zHooSnYDK+cEhx/tAJqh6UgMNalyzweW yWXBCVKmqgSirQglmgFWC4qtRmSU1WCoN9frXCyrCjx8O0EaMcRDUedkZ0UwL5Y9Y2BStI3OTNDo Ayv18oWsPC3k9pson7C2op5Z+NC++xfObzhlEx/kRwfTHFaJEU9zvoKXvHjQk/BdfTdrTqfDkhtB PZnQ6iukdi0RVxhxOzF3M3FAXEmTMCdzNqEKGlh0Yi+BxBu2cBwgxhet8YzYouGNd3mi0LXbtEte OzEjiAnWARGkEt0rwi6tzkgaWrEzaxlHpOyW0pLY729abykXMvynST7Dr+62++TsCEyMg7/uoV/v I/thP+c7pQeVrtpJqcgqBsHGKdB11rGLQhfK7YiWLV2h61gG+xpQJ9vTUCKYkkHiAivH6FzGCUAa 5u7yx1L/ksSLFDsbbLwoXYwa+mr+qRLe8/G94wdlkRPTjZha/tu5CB68Cyhmjw+I4rj6np7b77V/ QmR3dlZ6RLSOqoc8y3BLxU0/WyNjkeZjX3uuMhw9WAkrlQb50XdEjXwdyV4eDcAjIva0VChNPCik Gaa6QYuUKmFJci4MYhZfW0hr+At2px5uql4wTupQieWdKwVruNy8igZhxEH0OHFMFnBsq3RD5lBd IE0Z5muGN7gzSYvws3k24v5NFdkcpbAPZbL30DFWxj63KwkhdTrTVs7ji6jjQ= X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: Edward Adam Davis To: syzbot+60740c6a17a5b5eb1f5a@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [usb?] memory leak in hidg_bind Date: Mon, 10 Aug 2026 12:33:57 +0800 X-OQ-MSGID: <20260810043356.56995-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a78d160.01d0871a.3a0d52.0091.GAE@google.com> References: <6a78d160.01d0871a.3a0d52.0091.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 183a25f65ac8..86c57c3aa8e0 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -1593,6 +1593,8 @@ static void purge_configs_funcs(struct gadget_info *gi) list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) { list_move(&f->list, &cfg->func_list); + if (f->disable) + f->disable(f); if (f->unbind) { dev_dbg(&gi->cdev.gadget->dev, "unbind function '%s'/%p\n", diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 3c6b43d06a6d..0799220aeb13 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1158,13 +1158,15 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) hidg->get_req->zero = 0; hidg->get_req->complete = hidg_get_report_complete; hidg->get_req->context = hidg; - hidg->get_report_returned = true; + hidg->get_report_returned = false; /* maybe allocate device-global string IDs, and patch descriptors */ us = usb_gstrings_attach(c->cdev, ct_func_strings, ARRAY_SIZE(ct_func_string_defs)); - if (IS_ERR(us)) - return PTR_ERR(us); + if (IS_ERR(us)) { + status = PTR_ERR(us); + goto fail; + } hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id; /* allocate instance-specific interface IDs, and patch descriptors */