Re: [PATCH] usb: gadgetfs: fix use-after-free after a failed bind

[Greg Kroah-Hartman]

On Sun, Oct 18, 2026 at 04:34:34PM +0000, Eklavya Singh wrote:
> gadgetfs_bind() takes its reference on dev_data only right before it
> returns success, but its error path calls gadgetfs_unbind(), which
> always calls put_dev(). So when bind fails it drops a reference it
> never took.
> 
> With ep0 open the count is 2, one for the superblock and one for the
> open file. A failed bind takes it to 1, closing ep0 frees dev_data,
> and the superblock still points at it. The next open of ep0 then takes
> dev->lock on freed memory:
> 
>   BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50
>    gadget_dev_open+0x4b/0x1b0 drivers/usb/gadget/legacy/inode.c:1919
> 
> syzbot gets there by making an allocation in bind fail, which is the
> "failed to start USB Gadget filesystem: -12" message right before the
> report.
> 
> Take the reference before anything in bind can fail, so that
> gadgetfs_unbind() always has one to drop.
> 
> I tested this on dummy_hcd by writing a config to ep0 with fail-nth
> set and then closing and reopening ep0, for every fail-nth value the
> write goes through. Without the patch KASAN reports the use-after-free
> right after the first failed bind. With it, 122 failed binds give no
> reports and the last bind works.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+1459655b2bf1e798f9d0@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1459655b2bf1e798f9d0
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Eklavya Singh <eklavyasingh2106@xxxxxxxxx>
> ---
>  drivers/usb/gadget/legacy/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index 67c6ffaf4..f5b97dcd4 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -1688,6 +1688,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  		return -ENODEV;
>  	}
>  
> +	get_dev(dev);
>  	set_gadget_data (gadget, dev);
>  	dev->gadget = gadget;
>  	gadget->ep0->driver_data = dev;
> @@ -1706,7 +1707,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  	spin_lock_irq(&dev->lock);
>  	dev->state = STATE_DEV_UNCONNECTED;
>  	spin_unlock_irq(&dev->lock);
> -	get_dev (dev);
>  	return 0;
>  
>  enomem:
> -- 
> 2.55.0
> 

Isn't this already fixed in the usb-next tree?

thanks,

greg k-h