Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv

[syzbot <syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com>]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: refcount bug in usb_add_gadget

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#1: syz-executor381/5998
Modules linked in:
CPU: 1 UID: 0 PID: 5998 Comm: syz-executor381 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 4b ae 02 fd 48 8d 3d f4 64 f7 0a 67 48 0f b9 3a eb 4a e8 38 ae 02 fd 48 8d 3d f1 64 f7 0a <67> 48 0f b9 3a eb 37 e8 25 ae 02 fd 48 8d 3d ee 64 f7 0a 67 48 0f
RSP: 0018:ffffc90003d87968 EFLAGS: 00010293
RAX: ffffffff84c329f8 RBX: 0000000000000002 RCX: ffff888031b29f00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8fba8ef0
RBP: 0000000000000000 R08: ffff888031b29f00 R09: 0000000000000005
R10: 0000000000000100 R11: 0000000000000004 R12: ffff88803b7285d8
R13: 0000000000000000 R14: ffff888025decd90 R15: dffffc0000000000
FS:  00007f4ec54416c0(0000) GS:ffff888125d35000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f413f414140 CR3: 00000000400de000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __refcount_add include/linux/refcount.h:-1 [inline]
 __refcount_inc include/linux/refcount.h:366 [inline]
 refcount_inc include/linux/refcount.h:383 [inline]
 kref_get include/linux/kref.h:45 [inline]
 kobject_get+0xfa/0x120 lib/kobject.c:643
 get_device drivers/base/core.c:3868 [inline]
 device_add+0x24/0xb80 drivers/base/core.c:3648
 usb_add_gadget+0x47d/0x700 drivers/usb/gadget/udc/core.c:1461
 usb_add_gadget_udc_release+0x1a4/0x1f0 drivers/usb/gadget/udc/core.c:1517
 dummy_udc_probe+0x6e1/0x7e0 drivers/usb/gadget/udc/dummy_hcd.c:1121
 platform_probe+0xf9/0x190 drivers/base/platform.c:1439
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 device_driver_attach+0xe0/0x1d0 drivers/base/dd.c:1203
 bind_store+0x1d3/0x220 drivers/base/bus.c:267
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ec549e1de
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f4ec5440f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4ec54416c0 RCX: 00007f4ec549e1de
RDX: 000000000000000b RSI: 00007f4ec54e71b9 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000010 R14: 00007ffc9aa26bd0 R15: 00007ffc9aa26cb8
 </TASK>
----------------
Code disassembly (best guess):
   0:	eb 66                	jmp    0x68
   2:	85 db                	test   %ebx,%ebx
   4:	74 3e                	je     0x44
   6:	83 fb 01             	cmp    $0x1,%ebx
   9:	75 4c                	jne    0x57
   b:	e8 4b ae 02 fd       	call   0xfd02ae5b
  10:	48 8d 3d f4 64 f7 0a 	lea    0xaf764f4(%rip),%rdi        # 0xaf7650b
  17:	67 48 0f b9 3a       	ud1    (%edx),%rdi
  1c:	eb 4a                	jmp    0x68
  1e:	e8 38 ae 02 fd       	call   0xfd02ae5b
  23:	48 8d 3d f1 64 f7 0a 	lea    0xaf764f1(%rip),%rdi        # 0xaf7651b
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	eb 37                	jmp    0x68
  31:	e8 25 ae 02 fd       	call   0xfd02ae5b
  36:	48 8d 3d ee 64 f7 0a 	lea    0xaf764ee(%rip),%rdi        # 0xaf7652b
  3d:	67                   	addr32
  3e:	48                   	rex.W
  3f:	0f                   	.byte 0xf


Tested on:

commit:         d58772d8 Merge tag 'regmap-fix-v7.2-rc7' of git://git...
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=164c1179580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6ddb3079499f48cb
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11b98979580000