Re: [BUG] usb: gadget: dummy_hcd: general protection fault in dummy_set_selfpowered after unbinding dummy_hcd.0

[Alan Stern]

On Mon, Aug 31, 2026 at 05:02:28PM +0800, Xianying Wang wrote:
> Hi,
> 
> I would like to report that a previously observed
> syzkaller-triggerable crash is still reproducible on Linux 7.2-rc3.
> 
> The reproducer first unbinds `dummy_hcd.0` through sysfs, after which
> the kernel logs show that the dummy HCD/UDC instance is removed and
> the emulated USB bus is deregistered. It then writes `dummy_udc.0` to
> the gadget's `UDC` attribute through configfs, which triggers gadget
> binding.
> 
> During the bind path, `configfs_composite_bind()` calls into
> `composite_dev_prepare()`, which in turn invokes
> `usb_gadget_set_selfpowered()`. This reaches `dummy_set_selfpowered()`
> in `drivers/usb/gadget/udc/dummy_hcd.c`, where the driver obtains the
> backing dummy HCD from `gadget_to_dummy_hcd(_gadget)` and dereferences
> it. At that point, the associated HCD pointer appears to be NULL or no
> longer valid after the earlier unbind/remove sequence, leading to the
> reported KASAN null-ptr-deref / general protection fault.
> 
> Based on the call trace and the reproducer flow, this seems to be a
> lifetime/state validation issue in the dummy UDC path: after
> `dummy_hcd.0` has been removed, binding `dummy_udc.0` is still able to
> proceed far enough to call gadget operations that assume a live
> associated HCD.
> 
> This appears to match the previously reported `general protection
> fault in dummy_set_selfpowered` issue, and I am sending this report
> because it is still reproducible on 7.2-rc3.
> 
> Thank you for your time and review.

Does the patch submitted here:

https://lore.kernel.org/linux-usb/18ec3122-7566-49e5-9964-1028857405b1@xxxxxxxxxxxxxxx/

fix the problem for you?

Alan Stern