From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EAEC93F413F for ; Tue, 25 Aug 2026 10:46:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787654769; cv=none; b=MB6VRw/C8KHAoC3LxZeMQTPCR0nktl2UVuWlAiEK+GYcLIG4WtaLrzBOamnkdSOe7LjjP6IfIaLhuLN3IqQ0/ldAQljTcz4WJVxDYXr61zNaU0hlKh+aSk4s5MOTqQNglZz7daFPjiKXDjEFHXvIiP2qzEUdt3fpo+3AJtIt29U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787654769; c=relaxed/simple; bh=FPYe1crnsYHtn0U7WPNaYM9b5z0ifdW88rHUuc4KNhA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m+tywomjrBvqtaj3/+Nxr3ExbX1NMwQZI2/RNUYanPWrJzNiv9hZZiH9vA+FEWvW84/4muwLkLFAUBSIeoDpJ/fPjB/KqAQMazdGMoVehdVxAFw2awxpTJMmv2eKboNDkBqg0B4zMUWnSh8TqA1Upzpa9+lKDR8viYNtYQaE3lE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PuUwDybL; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PuUwDybL" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2d530328efbso39532155ad.0 for ; Tue, 25 Aug 2026 03:46:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787654766; x=1788259566; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ac16pfv2Rj18iPUVLOrADWTqxfqfViLMohr3+8pP5Us=; b=PuUwDybLEjuh5FNODCn48CdyAFNEix2EFjWpfm4XZvNQawtOYGOHszdX8/Sb8Pu1wQ jD+3FSjXeTb5q39ffyloFP2ppAy0jQa7rU1FkH1PgpwUN5x8asG8TBtp2r9rYd8+VbWf Mt3q0HCR2IBDu3r7uu7fnjZRl2S9GKTDSiaQ6s+bLCS39QSEoFm96HJqjVoDNdJjDCtl 4Y7RFgsJ4MTNQqefHbSRfdaCudX1cZI38FBvQ+fLdarzns4cCfsPECFu93bG4Yo4C9t3 WXwRBHIgvYFlrZw0TAquDb/7qqT2zlV+rf0XJKA9GxYdZm50EdiQzd1GcxygO4H3Ydhp B3Xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787654766; x=1788259566; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ac16pfv2Rj18iPUVLOrADWTqxfqfViLMohr3+8pP5Us=; b=VSWP8lkKCWuIUpTrZnDGySqqeyaIhClnpu0DcotaXkKIxD/TNVjmKBM28sQTSsep1P wp/EwG8X4X3oPlkTcruGywPqvSDm0uul7/FukxG8BIH4deUGFByyAN46S2F4ZmjvDl3w +nK+KoM7/IeC8GXT9+kSeGYFp7Lm0472IiHcn8PQkoAtQiPOrILuhMucxT3AgsIdvw/t iZAoKxeuVq6MahurbRDwBiz3NtwjramY2YMFlOyxTs+KrUuonv+s4MnuqIswfgF7gAzT ih9blXIaL3EhArXIDhBwBLHLibh4xKYTk3VIXRr3K2vLn2LHPb4yfNincVgjZy/Iy3MA j+sA== X-Forwarded-Encrypted: i=1; AHgh+Rp5C4mCfBbGILEhIbgSOGzSDhNgcxqDeWXjOe0ddAtMow15Y/wjBAWFUkHByimSrZjMsx8E+2OuZUtTVmg=@vger.kernel.org X-Gm-Message-State: AFuF++neTCfjsTE65G7v5FLSSGOBKS/9TPGgZlGA3o3rF7QrrgWICD8h 6k2iT1jLG2ZzOrJ4uzLxYhSW8xY0LFo6u2OuwQEG0VKnSe414xeJxi1s X-Gm-Gg: AR+sD11Qe9mrD8AIR5egJyHtDQujVPJRF5VSW2/P9u+A1KRzETWdw0YHS9Y/TDgDBq5 nI4dpJ4hWFPhIDp2M44J+jJV4utZXGvXvJCyHUaALSbehuV8prpgtNcv++n8cEXY9fgudpvL3Tq brh4Vms7HgKoSckNvFMLizEIyB5PClBfMuvlcoRMAImp3X3ImbzolkTByuW+Z7qS6HRf/W8K8DU 3xtMdJm6qwOdvaTy+2jqtFtp5MMi0xi4oNVOj53pippVndVV9JfkglGQj79b2xDjk2zLLiRGkk8 /DGRiexjY3M4AnuwJcpSe4l9SsVtOEmci0jY+EybxFQDZ8ialG/9UuNDN1TtvT/x210JJ+KiGwj IJB0FHyoFiag1boNZjhVaA/gNjWPm5KAq7S2Cls+ws7SRfrfIccKsyRwjumjg7rCEwHsZADuHUr lJ7AAHhdrBeTQ1OaqWS2nX55eM4sCSQ/JmWGxeKwU4ocXtuiBWcl6+V+nR9HmuKnLORDfHJT2lY tHDQEK0vKcNnWE2MKA39emkSVz4v6cWGg== X-Received: by 2002:a17:902:ec87:b0:2cf:8131:75e8 with SMTP id d9443c01a7336-2d64b11893amr525939445ad.13.1787654765892; Tue, 25 Aug 2026 03:46:05 -0700 (PDT) Received: from localhost ([2409:40c4:101c:e5a9:a28f:e499:1b07:43b3]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f90cb8e3sm51146610eec.12.2026.08.25.03.46.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 03:46:05 -0700 (PDT) From: Lovekesh Solanki To: jjy600901@snu.ac.kr Cc: brauner@kernel.org, eulgyukim@snu.ac.kr, gregkh@linuxfoundation.org, jack@suse.cz, kees@kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, stern@rowland.harvard.edu, viro@zeniv.linux.org.uk, Lovekesh Solanki , stable@vger.kernel.org Subject: [PATCH] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Date: Tue, 25 Aug 2026 16:16:01 +0530 Message-ID: <20260825104601.315401-1-lovekeshsolanki00@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260824160022.2378192-1-jjy600901@snu.ac.kr> References: <20260824160022.2378192-1-jjy600901@snu.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gadget_dev_ioctl() reads dev->gadget outside the dev->lock, while gadgetfs_bind() writes it without holding the lock. A concurrent bind can update dev->gadget and dev->state under the lock while the ioctl thread holds a stale NULL copy, causing a NULL pointer dereference at offset 0x28 (gadget->ops->ioctl). Read dev->gadget inside the locked region, before the state check, so the state and gadget pointer are always consistent. Cc: stable@vger.kernel.org Reported-by: Eulgyu Kim Link: https://lore.kernel.org/all/20260824160022.2378192-1-jjy600901@snu.ac.kr/ Reported-by: Jaeyoung Chung Link: https://lore.kernel.org/all/20260824160022.2378192-1-jjy600901@snu.ac.kr/ Signed-off-by: Lovekesh Solanki --- drivers/usb/gadget/legacy/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index d87a8ab51510..e9f7d7c1a6a3 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1251,14 +1251,15 @@ ep0_poll (struct file *fd, poll_table *wait) static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value) { struct dev_data *dev = fd->private_data; - struct usb_gadget *gadget = dev->gadget; + struct usb_gadget *gadget; long ret = -ENOTTY; spin_lock_irq(&dev->lock); + gadget = dev->gadget; if (dev->state == STATE_DEV_OPENED || dev->state == STATE_DEV_UNBOUND) { /* Not bound to a UDC */ - } else if (gadget->ops->ioctl) { + } else if (gadget && gadget->ops->ioctl) { ++dev->udc_usage; spin_unlock_irq(&dev->lock); -- 2.55.0