[PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Rafael Alejandro Diaz Cruz]

UAF is caused by syzkaller reproducer forcing
the failure of gadgetfs_fill_super()

When gadgetfs_fill_super() fails, it's error path calls
put_dev() which drops refcount inside the_device to 0
and frees the objet. But the_device pointer is not
cleared, leading to point at freed memory.

VFS will then call gadgetfs_kill_sb() after mount
failure leading to put_dev() to be called on the
already freed pointer.

Fix by setting the_device = NULL during error path
before calling put_dev() inside gadgetfs_fill_super()
so that gadgetfs_kill_sb() skips put_dev().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
 drivers/usb/gadget/legacy/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51510..3e2bce7543d4 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
 	rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
 	if (rc) {
 		put_dev(dev);
+		the_device = NULL;
 		goto Enomem;
 	}
 
-- 
2.43.0

Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Alan Stern]

On Tue, Sep 01, 2026 at 10:01:27PM -0700, Rafael Alejandro Diaz Cruz wrote:
> UAF is caused by syzkaller reproducer forcing
> the failure of gadgetfs_fill_super()

Just a minor comment: The fact that you used syzkaller to cause the UAF 
in your testing isn't relevant.  Memory allocation failures can occur in 
real life, without fuzzing, and the driver needs to deal with them 
properly.

> When gadgetfs_fill_super() fails, it's error path calls
> put_dev() which drops refcount inside the_device to 0
> and frees the objet. But the_device pointer is not
> cleared, leading to point at freed memory.
> 
> VFS will then call gadgetfs_kill_sb() after mount
> failure leading to put_dev() to be called on the
> already freed pointer.
> 
> Fix by setting the_device = NULL during error path
> before calling put_dev() inside gadgetfs_fill_super()
> so that gadgetfs_kill_sb() skips put_dev().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
> Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>

Since this fixes a real bug, you should add:

CC: <stable@vger.kernel.org>

> ---

Reviewed-by: Alan Stern <stern@rowland.harvard.edu>

Alan Stern

>  drivers/usb/gadget/legacy/inode.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index d87a8ab51510..3e2bce7543d4 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
>  	rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
>  	if (rc) {
>  		put_dev(dev);
> +		the_device = NULL;
>  		goto Enomem;
>  	}
>  
> -- 
> 2.43.0
> 
> 

Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Alan Stern]

On Wed, Sep 02, 2026 at 07:18:25PM -0700, Rafael Alejandro Díaz Cruz wrote:
> Do I need to create a new patch for this?

You don't really need to, but it wouldn't hurt and it would make things 
easier for Greg KH.  Don't forget to list the changes from v1 below the 
"---" line.

Same goes for the second patch.

Alan Stern

> El El mié, sept 2, 2026 a la(s) 7:38 a.m., Alan Stern <
> stern@rowland.harvard.edu> escribió:
> 
> > On Tue, Sep 01, 2026 at 10:01:27PM -0700, Rafael Alejandro Diaz Cruz wrote:
> > > UAF is caused by syzkaller reproducer forcing
> > > the failure of gadgetfs_fill_super()
> >
> > Just a minor comment: The fact that you used syzkaller to cause the UAF
> > in your testing isn't relevant.  Memory allocation failures can occur in
> > real life, without fuzzing, and the driver needs to deal with them
> > properly.
> >
> > > When gadgetfs_fill_super() fails, it's error path calls
> > > put_dev() which drops refcount inside the_device to 0
> > > and frees the objet. But the_device pointer is not
> > > cleared, leading to point at freed memory.
> > >
> > > VFS will then call gadgetfs_kill_sb() after mount
> > > failure leading to put_dev() to be called on the
> > > already freed pointer.
> > >
> > > Fix by setting the_device = NULL during error path
> > > before calling put_dev() inside gadgetfs_fill_super()
> > > so that gadgetfs_kill_sb() skips put_dev().
> > >
> > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > > Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
> > > Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
> > > Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
> >
> > Since this fixes a real bug, you should add:
> >
> > CC: <stable@vger.kernel.org>
> >
> > > ---
> >
> > Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
> >
> > Alan Stern
> >
> > >  drivers/usb/gadget/legacy/inode.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > >
> > > diff --git a/drivers/usb/gadget/legacy/inode.c
> > b/drivers/usb/gadget/legacy/inode.c
> > > index d87a8ab51510..3e2bce7543d4 100644
> > > --- a/drivers/usb/gadget/legacy/inode.c
> > > +++ b/drivers/usb/gadget/legacy/inode.c
> > > @@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb,
> > struct fs_context *fc)
> > >       rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
> > >       if (rc) {
> > >               put_dev(dev);
> > > +             the_device = NULL;
> > >               goto Enomem;
> > >       }
> > >
> > > --
> > > 2.43.0
> > >
> > >
> >

Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Rafael Alejandro Díaz Cruz]

Which changes? Currently I'm on the new v1 and all I would do
is remove the top paragraph you said was unnecessary. Or do
you mean add the "Reviewed-by" tag that you added? (Thanks btw!)

I'm not sure either about adding it below the "---" line.
I haven't done that before....

I saw an example from some other patches and I guess I would
do the following:

 20 Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
 21 Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
 22 Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
 23 ---                                                      // ADD
THE PART BETWEEN THE "---" ?
 24 v2
 25 - Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
 26 ---
 27  drivers/usb/gadget/legacy/inode.c | 1 +
 28  1 file changed, 1 insertion(+)
 29
 30 diff --git a/drivers/usb

Is this correct?

Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Greg KH]

On Thu, Sep 03, 2026 at 10:12:27PM -0700, Rafael Alejandro Díaz Cruz wrote:
> Which changes? Currently I'm on the new v1 and all I would do
> is remove the top paragraph you said was unnecessary. Or do
> you mean add the "Reviewed-by" tag that you added? (Thanks btw!)
> 
> I'm not sure either about adding it below the "---" line.
> I haven't done that before....
> 
> I saw an example from some other patches and I guess I would
> do the following:
> 
>  20 Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
>  21 Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
>  22 Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
>  23 ---                                                      // ADD
> THE PART BETWEEN THE "---" ?
>  24 v2
>  25 - Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
>  26 ---
>  27  drivers/usb/gadget/legacy/inode.c | 1 +
>  28  1 file changed, 1 insertion(+)
>  29
>  30 diff --git a/drivers/usb
> 
> Is this correct?

The kernel documentation should explain how to do a new version, perhaps
re-read it?

thanks,

greg k-h

Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Alan Stern]

On Thu, Sep 03, 2026 at 10:12:27PM -0700, Rafael Alejandro Díaz Cruz wrote:
> Which changes?

I had to go back and look at the old email messages to figure out what 
you are talking about here.  Don't reply to emails without including 
enough context to let your reader (who may have to deal with hundreds of 
emails every day) know what's going on.

In this case, I was referring to the changes between your most recent 
patch submission (v1) and the submission you're planning to make (which 
will presumably be v2).

>  Currently I'm on the new v1 and all I would do
> is remove the top paragraph you said was unnecessary. Or do
> you mean add the "Reviewed-by" tag that you added? (Thanks btw!)

I meant everything that will change between v1 and v2.  Tags and all.

> I'm not sure either about adding it below the "---" line.
> I haven't done that before....

Now's your chance.  :-)

> I saw an example from some other patches and I guess I would
> do the following:
> 
>  20 Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
>  21 Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
>  22 Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
>  23 ---                                                      // ADD
> THE PART BETWEEN THE "---" ?
>  24 v2
>  25 - Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
>  26 ---
>  27  drivers/usb/gadget/legacy/inode.c | 1 +
>  28  1 file changed, 1 insertion(+)
>  29
>  30 diff --git a/drivers/usb
> 
> Is this correct?

No.

All you have to do is copy the format of the other patch submissions in 
the email archives.  It should look something like this (note that 
there is only one "---" line!):

----------------------------------------------------------------
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
---

Changes from v1:

	Removed unnecessary reference to syzkaller in the description.

	Added Reviewed-by: tag.

 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
----------------------------------------------------------------

Alan Stern