Re: Oops when rebinding f_hid while /dev/hidg* is still opened

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Mon, Mar 23, 2026 at 06:11:27PM +0100, Michael Zimmermann wrote:
> > This bug has happened a lot on many gadget drivers, I think we fixed a
> > bunch of them already, can you verify this is still an issue on the
> > latest 7.0-rc4 or 6.19.y kernel release (6.17 is very old and obsolete
> > and insecure, don't run that thing...)
> 
> Apparently, Fedora updates their images very rarely and they need a
> package manager update, sorry about that.
> 
> I now tested it 6.19.8-200.fc43.aarch64 and the bug is still there. I
> then switched to testing with buildroot, because that makes it easier
> to test different kernel versions. There, the behavior is a bit
> different but there's still a bug: Instead of immediately triggering
> an oops, everything appears fine on the first run of my script. But on
> the second run I see this:
> [   81.514126] refcount_t: underflow; use-after-free.

Ok, something is not being initialized again properly.

Take a look at the patch series at commit 41f71deda1c1 ("Merge patch
series "usb: gadget: Refactor function drivers to use __free()
cleanup"")

Perhaps something like commit 42988380ac67 ("usb: gadget: f_ecm:
Refactor bind path to use __free()") should be done for the f_hid
driver?  Can you work on that as you have a way to test this well, or do
you want a patch to test?

thanks,

greg k-h