Re: [PATCH RESEND] usb: gadget: f_loopback: fix descriptor leak on unbind

[Greg KH]

On Wed, Sep 02, 2026 at 10:51:53AM +0000, Chaithanya Lagisetty wrote:
> loopback_bind() allocates descriptor copies through
> usb_assign_descriptors(), but f_loopback does not release them during
> the unbind path. On every bind/unbind cycle of the gadget (for example
> by repeatedly writing the UDC attribute through configfs) a new set of
> descriptors is allocated while the previous ones are leaked. syzbot
> reported this via kmemleak:
> 
>   BUG: memory leak
>   unreferenced object 0xffff888016b8f180 (size 64):
>     comm "repro", pid 5613
>     backtrace:
>       __kmalloc_noprof+0x3bf/0x550
>       usb_copy_descriptors+0x6c/0x160
>       usb_assign_descriptors+0x48/0x180
>       loopback_bind+0xff/0x120
>       usb_add_function+0xca/0x270
>       configfs_composite_bind+0x667/0x9b0
>       gadget_bind_driver+0xed/0x390
> 
> Move descriptor cleanup to a new loopback_unbind() callback that frees
> them with usb_free_all_descriptors(), matching the lifecycle used by
> other gadget functions such as f_acm. With descriptors released during
> unbind, the usb_free_all_descriptors() call in lb_free_func() becomes
> redundant and can be removed.
> 
> Fixes: 10287baec761 ("usb: gadget: always update HS/SS descriptors and create a copy of them")
> Reported-by: syzbot+28cf08dec5895bd562e6@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=28cf08dec5895bd562e6

How was this tested?  I don't see syzbot doing the test, did you?

And did you forget an Assisted-by: tag?

thanks,

greg k-h