Re: [PATCH] usb: gadgetfs: fix use-after-free in ep_open()

[Deepanshu Kartikey]

On Fri, Jul 31, 2026 at 4:08 PM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>

> > Reported-by: syzbot+df9e891bf8ea586f846b@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
> > Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
>
> What commit id does this fix?
>

Fixes commit: I'll track down the exact SHA via git blame
on ep_open()'s lock ordering and resend with a proper Fixes: tag.


> And how did you find this?  Test it?
>

Found via syzbot fuzzing (KASAN slab-use-after-free),
not a manual audit reproduced locally under KASAN in a loop,
and confirmed via syzbot's #syz test against this patch.

> >
> >  static const char *CHIP;
> >  static DEFINE_MUTEX(sb_mutex);               /* Serialize superblock operations */
> > +static struct dev_data *the_device;
>
> Do we really want a single "device"?  Ah, it comes from elsewhere in
> thsi file, that's really not good...
>

I don't personally use gadgetfs found this purely from the syzbot report.
Happy to help check whether it's still in active use anywhere if that's useful,
or if you'd rather this go toward removing the legacy driver
 instead of patching it, that's fine by me too; your call.



> >  ep_open (struct inode *inode, struct file *fd)
> >  {
> > -     struct ep_data          *data = inode->i_private;
> > -     int                     value = -EBUSY;
> > +     struct dev_data *dev = the_device;
>
> Why isn't this coming from the inode or file?
>
>

Fair point; it doesn't need the_device at all.
I'll derive dev frominstead (setting sb->s_fs_info = dev in
gadgetfs_fill_super()),
which is properly scoped to this inode's mount rather than relying on
the global singleton.


> > -     rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
> > +     rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations, NULL);
>
> When we have to look up what a random parameter is, when you set it to
> NULL, that's usually not a good way to write a function.
>

Correct, I will remove this no longer needed once I pick dev from
inode->i_sb->s_fs_info

I will send the patch v2 shortly

Thanks

Deepanshu