Re: [PATCH v2] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

[Alan Stern]

On Tue, Aug 25, 2026 at 10:43:43PM +0530, Lovekesh Solanki wrote:
> gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but
> dev->state is checked after acquiring the lock. Therefore a concurrent
> bind can change the device state between these operations, which can
> leave ioctl with a stale NULL gadget pointer and causing a NULL pointer 
> dereference at gadget->ops->ioctl.
> 
> Read dev->gadget while holding dev->lock so that the gadget pointer
> and device state are sampled consistently.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Eulgyu Kim <eulgyukim@xxxxxxxxx>
> Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@xxxxxxxxx/
> Reported-by: Jaeyoung Chung <jjy600901@xxxxxxxxx>
> Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@xxxxxxxxx/
> Signed-off-by: Lovekesh Solanki <lovekeshsolanki00@xxxxxxxxx>
> ---
> Changes in v2:
> - Fix Link tag pointing to wrong bug report.
> - Remove the unnecessary NULL check.
> - Reword commit message as per Alan's review.

Reviewed-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>

>  drivers/usb/gadget/legacy/inode.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index d87a8ab51510..12819e8c265d 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -1251,10 +1251,11 @@ ep0_poll (struct file *fd, poll_table *wait)
>  static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned long value)
>  {
>  	struct dev_data		*dev = fd->private_data;
> -	struct usb_gadget	*gadget = dev->gadget;
> +	struct usb_gadget	*gadget;
>  	long ret = -ENOTTY;
>  
>  	spin_lock_irq(&dev->lock);
> +	gadget = dev->gadget;
>  	if (dev->state == STATE_DEV_OPENED ||
>  			dev->state == STATE_DEV_UNBOUND) {
>  		/* Not bound to a UDC */
> -- 
> 2.55.0