Re: [PATCH RESEND] usb: gadget: f_loopback: fix descriptor leak on unbind

[Chaithanya Lagisetty]

On Thu, Sep 10, 2026 at 06:32:50PM +0200, Greg KH wrote:
> How was this tested?  I don't see syzbot doing the test, did you?

I ran the syzbot reproducer from the reported bug against both an
unpatched and a patched kernel.

Both kernels were built from the same source tree and .config, with the
same compiler and QEMU environment; the patch was the only difference.

On the unpatched kernel, the reproducer triggered 3 "BUG: memory leak"
reports in 5 iterations.  All reported allocations originated from
loopback_bind() through usb_assign_descriptors() / usb_copy_descriptors():

  BUG: memory leak
  unreferenced object 0xffff888016dad4c0 (size 64):
    comm "repro", pid 5597, jiffies 4294942168
    backtrace (crc c8d54481):
      __kmalloc_noprof+0x391/0x540
      usb_copy_descriptors+0x6c/0x170
      usb_assign_descriptors+0x6c/0x180
      loopback_bind+0xf4/0x130
      usb_add_function+0xca/0x270
      configfs_composite_bind+0x6dc/0xa90
      gadget_bind_driver+0xf7/0x3e0
      ...
      gadget_dev_desc_UDC_store+0x153/0x1e0

On the patched kernel, I ran 25 reproducer iterations and observed no
"BUG: memory leak" reports.  I also performed three explicit kmemleak
scans, all of which were clean.

> And did you forget an Assisted-by: tag?

Yes, I did.  I will add:

  Assisted-by: Cursor:opus-5

in the next revision.

Regards,
Chaithanya