[PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Dmitry Antipov]

In 'gadgetfs_bind()', 'get_dev()' on appropriate 'struct dev_data'
instance should be performed immediately after the pointer is stored.
Otherwise an attempt to handle -ENOMEM later will issue an unbalanced
'put_dev()' in 'gadgetfs_unbind()', thus leading to UAF errors.

Reported-by: syzbot+6aa97991da41499aa852@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6aa97991da41499aa852
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51510..a86a1c68903e 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1681,6 +1681,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	set_gadget_data (gadget, dev);
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
+	get_dev(dev);
 
 	/* preallocate control response and buffer */
 	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
@@ -1696,7 +1697,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:
-- 
2.55.0

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 12:12:58PM +0300, Dmitry Antipov wrote:
> In 'gadgetfs_bind()', 'get_dev()' on appropriate 'struct dev_data'
> instance should be performed immediately after the pointer is stored.
> Otherwise an attempt to handle -ENOMEM later will issue an unbalanced
> 'put_dev()' in 'gadgetfs_unbind()', thus leading to UAF errors.
> 
> Reported-by: syzbot+6aa97991da41499aa852@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6aa97991da41499aa852
> Cc: stable@vger.kernel.org
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
>  drivers/usb/gadget/legacy/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

What commit id does this fix?

thanks,

greg k-h

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Dmitry Antipov]

On 8/3/26 12:15 PM, Greg Kroah-Hartman wrote:

> What commit id does this fix?

IIUC this code is really ancient and 1da177e4c3f4 ("Linux-2.6.12-rc2")
looks the only match.

Dmitry

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 01:33:08PM +0300, Dmitry Antipov wrote:
> On 8/3/26 12:15 PM, Greg Kroah-Hartman wrote:
> 
> > What commit id does this fix?
> 
> IIUC this code is really ancient and 1da177e4c3f4 ("Linux-2.6.12-rc2")
> looks the only match.

So this is not anything a normal user could ever hit, given the age?
It's only something that fault-injection causes?

thanks,

greg k-h

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Dmitry Antipov]

On 8/3/26 3:24 PM, Greg Kroah-Hartman wrote:

> So this is not anything a normal user could ever hit, given the age?
> It's only something that fault-injection causes?

Not sure. Anyway it just looks like the regular -ENOMEM handling which
may be found almost anywhere else.

Dmitry

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 01:33:08PM +0300, Dmitry Antipov wrote:
> On 8/3/26 12:15 PM, Greg Kroah-Hartman wrote:
> 
> > What commit id does this fix?
> 
> IIUC this code is really ancient and 1da177e4c3f4 ("Linux-2.6.12-rc2")
> looks the only match.

Also, do you actually use this code?  I'd like to drop all the "legacy"
USB gadget code, given that syzbot has suddenly just woken up and is
finding lots of issues that no one has ever reported, as I don't think
anyone actually uses this at all.  But it would be good to be sure.

thanks,

greg k-h

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Dmitry Antipov]

On 8/3/26 3:25 PM, Greg Kroah-Hartman wrote:

> I'd like to drop all the "legacy" USB gadget code

Hm. Then I would like to ask you to mark this code with Obsolete:
in MAINTAINERS and wait for some grace period at least.

Dmitry

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 04:13:05PM +0300, Dmitry Antipov wrote:
> On 8/3/26 3:25 PM, Greg Kroah-Hartman wrote:
> 
> > I'd like to drop all the "legacy" USB gadget code
> 
> Hm. Then I would like to ask you to mark this code with Obsolete:
> in MAINTAINERS and wait for some grace period at least.

Grace periods never work, I'll just go make a patch to delete them all
now and see who says anything :)

thanks,

greg k-h

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 03:26:47PM +0200, Greg Kroah-Hartman wrote:
> On Mon, Aug 03, 2026 at 04:13:05PM +0300, Dmitry Antipov wrote:
> > On 8/3/26 3:25 PM, Greg Kroah-Hartman wrote:
> > 
> > > I'd like to drop all the "legacy" USB gadget code
> > 
> > Hm. Then I would like to ask you to mark this code with Obsolete:
> > in MAINTAINERS and wait for some grace period at least.
> 
> Grace periods never work, I'll just go make a patch to delete them all
> now and see who says anything :)
> 

Ok, it looks like people do use the raw_gadget driver for testing, so
I'll see about leaving that for now, let's see how much we can trim-down
before getting there...

thanks,

greg k-h

Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Alan Stern]

On Mon, Aug 03, 2026 at 03:36:31PM +0200, Greg Kroah-Hartman wrote:
> On Mon, Aug 03, 2026 at 03:26:47PM +0200, Greg Kroah-Hartman wrote:
> > On Mon, Aug 03, 2026 at 04:13:05PM +0300, Dmitry Antipov wrote:
> > > On 8/3/26 3:25 PM, Greg Kroah-Hartman wrote:
> > > 
> > > > I'd like to drop all the "legacy" USB gadget code
> > > 
> > > Hm. Then I would like to ask you to mark this code with Obsolete:
> > > in MAINTAINERS and wait for some grace period at least.
> > 
> > Grace periods never work, I'll just go make a patch to delete them all
> > now and see who says anything :)
> > 
> 
> Ok, it looks like people do use the raw_gadget driver for testing, so
> I'll see about leaving that for now, let's see how much we can trim-down
> before getting there...

It's worth pointing out that a bunch of the "legacy" gadget drivers are 
nothing more than pre-packaged, easy-to-use versions of various 
non-legacy function drivers.

Also, the zero.c legacy driver is not meant for normal use; its purpose 
is to assist in testing UDC and host controller drivers.

Alan Stern