Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in dev_config

[Alan Stern]

On Thu, Nov 05, 2026 at 05:12:32PM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e11160948333 riscv: vector: Fix output operands in context..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=12e4e525580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1c1b9a4a89432905
> dashboard link: https://syzkaller.appspot.com/bug?extid=3a56b27661cb0e004a40
> compiler:       riscv64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> userspace arch: riscv64
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-e1116094.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/69abda6e64cf/vmlinux-e1116094.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/2d7716a5dfdb/Image-e1116094.xz
> 
> AI-generated root cause summary:
> In drivers/usb/gadget/legacy/inode.c, gadgetfs_bind() only acquires a reference
> on struct dev_data (calling get_dev(dev)) at the very end of its success path
> (line 1709). If an error occurs earlier (such as in usb_ep_alloc_request() or
> activate_ep_files()), gadgetfs_bind() jumps to enomem and calls
> gadgetfs_unbind(), which unconditionally calls put_dev(dev) to release a
> reference that was never acquired. This reference count underflow prematurely
> frees struct dev_data via put_dev(). Furthermore, when driver probing fails
> during registration, usb_gadget_register_driver() still returns 0 because
> match_existing_only is not set on gadgetfs_driver, causing dev_config() to
> execute dev->gadget_registered = true on the already freed dev structure,
> resulting in a slab use-after-free write.
> 
> full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=3a56b27661cb0e004a40

This has already been fixed in Linus's tree.

#syz fix: cb3b441f2698 ("usb: gadget: fix refcount underflow in gadgetfs_bind() error path")

Alan Stern