Re: [PATCH usb-next v1] USB: gadget: Fix UAF in gadgetfs_fill_super()

[Alan Stern]

On Wed, Sep 02, 2026 at 07:18:25PM -0700, Rafael Alejandro Díaz Cruz wrote:
> Do I need to create a new patch for this?

You don't really need to, but it wouldn't hurt and it would make things 
easier for Greg KH.  Don't forget to list the changes from v1 below the 
"---" line.

Same goes for the second patch.

Alan Stern

> El El mié, sept 2, 2026 a la(s) 7:38 a.m., Alan Stern <
> stern@xxxxxxxxxxxxxxxxxxx> escribió:
> 
> > On Tue, Sep 01, 2026 at 10:01:27PM -0700, Rafael Alejandro Diaz Cruz wrote:
> > > UAF is caused by syzkaller reproducer forcing
> > > the failure of gadgetfs_fill_super()
> >
> > Just a minor comment: The fact that you used syzkaller to cause the UAF
> > in your testing isn't relevant.  Memory allocation failures can occur in
> > real life, without fuzzing, and the driver needs to deal with them
> > properly.
> >
> > > When gadgetfs_fill_super() fails, it's error path calls
> > > put_dev() which drops refcount inside the_device to 0
> > > and frees the objet. But the_device pointer is not
> > > cleared, leading to point at freed memory.
> > >
> > > VFS will then call gadgetfs_kill_sb() after mount
> > > failure leading to put_dev() to be called on the
> > > already freed pointer.
> > >
> > > Fix by setting the_device = NULL during error path
> > > before calling put_dev() inside gadgetfs_fill_super()
> > > so that gadgetfs_kill_sb() skips put_dev().
> > >
> > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > > Reported-by: syzbot+4a5c87a01894ca37f25c@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
> > > Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@xxxxxxxxx>
> >
> > Since this fixes a real bug, you should add:
> >
> > CC: <stable@xxxxxxxxxxxxxxx>
> >
> > > ---
> >
> > Reviewed-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> >
> > Alan Stern
> >
> > >  drivers/usb/gadget/legacy/inode.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > >
> > > diff --git a/drivers/usb/gadget/legacy/inode.c
> > b/drivers/usb/gadget/legacy/inode.c
> > > index d87a8ab51510..3e2bce7543d4 100644
> > > --- a/drivers/usb/gadget/legacy/inode.c
> > > +++ b/drivers/usb/gadget/legacy/inode.c
> > > @@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb,
> > struct fs_context *fc)
> > >       rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
> > >       if (rc) {
> > >               put_dev(dev);
> > > +             the_device = NULL;
> > >               goto Enomem;
> > >       }
> > >
> > > --
> > > 2.43.0
> > >
> > >
> >