Re: [BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Aug 31, 2026 at 05:02:28PM +0800, Xianying Wang wrote:
> Hi,
> 
> I would like to report that a previously observed
> syzkaller-triggerable crash is still reproducible on Linux 7.2-rc3.
> 
> The reproducer first unbinds `dummy_hcd.0` through sysfs, after which
> the kernel logs show that the dummy HCD/UDC instance is removed and
> the emulated USB bus is deregistered. It then writes `dummy_udc.0` to
> the gadget's `UDC` attribute through configfs, which triggers gadget
> binding.

Fun, but you do know that "unbind" will taint the kernel in the near
future :)

And the dummy_hcd code is just for testing, it's not a "normal" driver
that any user will ever hit.

> During the bind path, `configfs_composite_bind()` calls into
> `composite_dev_prepare()`, which in turn invokes
> `usb_gadget_set_selfpowered()`. This reaches `dummy_set_selfpowered()`
> in `drivers/usb/gadget/udc/dummy_hcd.c`, where the driver obtains the
> backing dummy HCD from `gadget_to_dummy_hcd(_gadget)` and dereferences
> it. At that point, the associated HCD pointer appears to be NULL or no
> longer valid after the earlier unbind/remove sequence, leading to the
> reported KASAN null-ptr-deref / general protection fault.
> 
> Based on the call trace and the reproducer flow, this seems to be a
> lifetime/state validation issue in the dummy UDC path: after
> `dummy_hcd.0` has been removed, binding `dummy_udc.0` is still able to
> proceed far enough to call gadget operations that assume a live
> associated HCD.
> 
> This appears to match the previously reported `general protection
> fault in dummy_set_selfpowered` issue, and I am sending this report
> because it is still reproducible on 7.2-rc3.

Patches are gladly accepted to resolve issues like this.  Why not make
one as you have a reproducer for it?

thanks,

greg k-h