[PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[Eklavya Singh]

gadgetfs_bind() takes its reference on dev_data only right before it
returns success, but its error path calls gadgetfs_unbind(), which
always calls put_dev(). So when bind fails it drops a reference it
never took.

With ep0 open the count is 2, one for the superblock and one for the
open file. A failed bind takes it to 1, closing ep0 frees dev_data,
and the superblock still points at it. The next open of ep0 then takes
dev->lock on freed memory:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
   gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919

syzbot gets there by making an allocation in bind fail, which is the
"failed to start USB Gadget filesystem: -12" message right before the
report.

Take the reference before anything in bind can fail, so that
gadgetfs_unbind() always has one to drop.

I tested this on dummy_hcd by writing a config to ep0 with fail-nth
set and then closing and reopening ep0, for every fail-nth value the
write goes through. Without the patch KASAN reports the use-after-free
right after the first failed bind. With it, 122 failed binds give no
reports and the last bind works.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+1459655b2bf1e798f9d0@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Eklavya Singh <eklavyasingh2106@xxxxxxxxx>
---
 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 67c6ffaf4..f5b97dcd4 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1688,6 +1688,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 		return -ENODEV;
 	}
 
+	get_dev(dev);
 	set_gadget_data (gadget, dev);
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
@@ -1706,7 +1707,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:
-- 
2.55.0