Re: [PATCH usb-next v2] USB: gadgetfs: Fix use-after-free in gadgetfs_kill_sb

[Rafael Alejandro Díaz Cruz]

I kept going at it and finally realized what was going on.

I added some logging statements as you suggested and
found that my 'how this bug is caused' is correct. It does
come from calling get_dev() after the error
paths, and the simple solution was to move get_dev()
right after the set_gadget_data().

As for 'why' the bug is happening, it basically comes from
the reproducer using failslab to force kmalloc() to fail inside
of usb_ep_alloc_request(). This will cause the following
error path to be taken:

dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
if (!dev->req)         // This is true on failslab
     goto enomem;

This will then skip get_dev() and go directly to
gadgetfs_unbind() -> put_dev()
creating the unbalanced refcount.

It was tricky to understand given that it was failing only
on the N-th failslab attempt. Luckily gdb could do all the
things I needed.

I'm also happy to share that even Claude was not able to
figure this out and could only confirm this was the cause
after I pointed it out.

I'm certain of what I found and will proceed to create the
next patch with an updated message.

Please let me know if there is anything else I should add.
I'll wait for your response before sending it out.