[BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[Xianying Wang]

Hi,

I would like to report that a previously observed
syzkaller-triggerable crash is still reproducible on Linux 7.2-rc3.

The reproducer first unbinds `dummy_hcd.0` through sysfs, after which
the kernel logs show that the dummy HCD/UDC instance is removed and
the emulated USB bus is deregistered. It then writes `dummy_udc.0` to
the gadget's `UDC` attribute through configfs, which triggers gadget
binding.

During the bind path, `configfs_composite_bind()` calls into
`composite_dev_prepare()`, which in turn invokes
`usb_gadget_set_selfpowered()`. This reaches `dummy_set_selfpowered()`
in `drivers/usb/gadget/udc/dummy_hcd.c`, where the driver obtains the
backing dummy HCD from `gadget_to_dummy_hcd(_gadget)` and dereferences
it. At that point, the associated HCD pointer appears to be NULL or no
longer valid after the earlier unbind/remove sequence, leading to the
reported KASAN null-ptr-deref / general protection fault.

Based on the call trace and the reproducer flow, this seems to be a
lifetime/state validation issue in the dummy UDC path: after
`dummy_hcd.0` has been removed, binding `dummy_udc.0` is still able to
proceed far enough to call gadget operations that assume a live
associated HCD.

This appears to match the previously reported `general protection
fault in dummy_set_selfpowered` issue, and I am sending this report
because it is still reproducible on 7.2-rc3.

Thank you for your time and review.

Kernel:

HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

report: https://pastebin.com/raw/ncMhmiK0
console output :https://pastebin.com/raw/1TSvPDWW
kernel config : https://pastebin.com/raw/fBXuYyvu

Relevant log:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 5928 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 07/24/2026
RIP: 0010:dummy_set_selfpowered+0xbb/0x150
drivers/usb/gadget/udc/dummy_hcd.c:905

Call Trace:
 <TASK>
 usb_gadget_set_selfpowered+0x6e/0x230 drivers/usb/gadget/udc/core.c:578
 composite_dev_prepare+0x2fa/0x320 drivers/usb/gadget/composite.c:2464
 configfs_composite_bind+0xa1/0x13f0 drivers/usb/gadget/configfs.c:1699
 gadget_bind_driver+0x2b3/0x770 drivers/usb/gadget/udc/core.c:1651
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x247/0xae0 drivers/base/dd.c:717
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
 __driver_attach+0x444/0x6d0 drivers/base/dd.c:1295
 bus_for_each_dev+0x235/0x2b0 drivers/base/bus.c:370
 bus_add_driver+0x340/0x630 drivers/base/bus.c:723
 driver_register+0x23a/0x310 drivers/base/driver.c:246
 usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1730
 gadget_dev_desc_UDC_store+0x1c7/0x2e0 drivers/usb/gadget/configfs.c:300
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x312/0x400 fs/configfs/file.c:229
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Re: [BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[Greg KH]

On Mon, Aug 31, 2026 at 05:02:28PM +0800, Xianying Wang wrote:
> Hi,
> 
> I would like to report that a previously observed
> syzkaller-triggerable crash is still reproducible on Linux 7.2-rc3.
> 
> The reproducer first unbinds `dummy_hcd.0` through sysfs, after which
> the kernel logs show that the dummy HCD/UDC instance is removed and
> the emulated USB bus is deregistered. It then writes `dummy_udc.0` to
> the gadget's `UDC` attribute through configfs, which triggers gadget
> binding.

Fun, but you do know that "unbind" will taint the kernel in the near
future :)

And the dummy_hcd code is just for testing, it's not a "normal" driver
that any user will ever hit.

> During the bind path, `configfs_composite_bind()` calls into
> `composite_dev_prepare()`, which in turn invokes
> `usb_gadget_set_selfpowered()`. This reaches `dummy_set_selfpowered()`
> in `drivers/usb/gadget/udc/dummy_hcd.c`, where the driver obtains the
> backing dummy HCD from `gadget_to_dummy_hcd(_gadget)` and dereferences
> it. At that point, the associated HCD pointer appears to be NULL or no
> longer valid after the earlier unbind/remove sequence, leading to the
> reported KASAN null-ptr-deref / general protection fault.
> 
> Based on the call trace and the reproducer flow, this seems to be a
> lifetime/state validation issue in the dummy UDC path: after
> `dummy_hcd.0` has been removed, binding `dummy_udc.0` is still able to
> proceed far enough to call gadget operations that assume a live
> associated HCD.
> 
> This appears to match the previously reported `general protection
> fault in dummy_set_selfpowered` issue, and I am sending this report
> because it is still reproducible on 7.2-rc3.

Patches are gladly accepted to resolve issues like this.  Why not make
one as you have a reproducer for it?

thanks,

greg k-h

Re: [BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[Alan Stern]

On Mon, Aug 31, 2026 at 05:02:28PM +0800, Xianying Wang wrote:
> Hi,
> 
> I would like to report that a previously observed
> syzkaller-triggerable crash is still reproducible on Linux 7.2-rc3.
> 
> The reproducer first unbinds `dummy_hcd.0` through sysfs, after which
> the kernel logs show that the dummy HCD/UDC instance is removed and
> the emulated USB bus is deregistered. It then writes `dummy_udc.0` to
> the gadget's `UDC` attribute through configfs, which triggers gadget
> binding.
> 
> During the bind path, `configfs_composite_bind()` calls into
> `composite_dev_prepare()`, which in turn invokes
> `usb_gadget_set_selfpowered()`. This reaches `dummy_set_selfpowered()`
> in `drivers/usb/gadget/udc/dummy_hcd.c`, where the driver obtains the
> backing dummy HCD from `gadget_to_dummy_hcd(_gadget)` and dereferences
> it. At that point, the associated HCD pointer appears to be NULL or no
> longer valid after the earlier unbind/remove sequence, leading to the
> reported KASAN null-ptr-deref / general protection fault.
> 
> Based on the call trace and the reproducer flow, this seems to be a
> lifetime/state validation issue in the dummy UDC path: after
> `dummy_hcd.0` has been removed, binding `dummy_udc.0` is still able to
> proceed far enough to call gadget operations that assume a live
> associated HCD.
> 
> This appears to match the previously reported `general protection
> fault in dummy_set_selfpowered` issue, and I am sending this report
> because it is still reproducible on 7.2-rc3.
> 
> Thank you for your time and review.

Does the patch submitted here:

https://lore.kernel.org/linux-usb/18ec3122-7566-49e5-9964-1028857405b1@mail.kernel.org/

fix the problem for you?

Alan Stern