Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Alan Stern]

On Tue, Sep 01, 2026 at 10:01:27PM -0700, Rafael Alejandro Diaz Cruz wrote:
> UAF is caused by syzkaller reproducer forcing
> the failure of gadgetfs_fill_super()

Just a minor comment: The fact that you used syzkaller to cause the UAF 
in your testing isn't relevant.  Memory allocation failures can occur in 
real life, without fuzzing, and the driver needs to deal with them 
properly.

> When gadgetfs_fill_super() fails, it's error path calls
> put_dev() which drops refcount inside the_device to 0
> and frees the objet. But the_device pointer is not
> cleared, leading to point at freed memory.
> 
> VFS will then call gadgetfs_kill_sb() after mount
> failure leading to put_dev() to be called on the
> already freed pointer.
> 
> Fix by setting the_device = NULL during error path
> before calling put_dev() inside gadgetfs_fill_super()
> so that gadgetfs_kill_sb() skips put_dev().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+4a5c87a01894ca37f25c@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
> Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@xxxxxxxxx>

Since this fixes a real bug, you should add:

CC: <stable@xxxxxxxxxxxxxxx>

> ---

Reviewed-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>

Alan Stern

>  drivers/usb/gadget/legacy/inode.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index d87a8ab51510..3e2bce7543d4 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
>  	rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
>  	if (rc) {
>  		put_dev(dev);
> +		the_device = NULL;
>  		goto Enomem;
>  	}
>  
> -- 
> 2.43.0
> 
>