From nobody Tue Sep 29 07:39:38 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F82233937E for ; Tue, 11 Aug 2026 06:08:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786428497; cv=none; b=KvNR8OjvuAFp4gaReZbLE7eVMDbL7wsPY+UCioicu58ZFvesVrBIovm+cgylEsY/ksPwK36Z3lbvnTZfP0vjDE6VRIa3bj0dohy3uBabt0Cj715TvnckDSZVfizYt+uiFdbWY3ovKBsai9EsJAWzvSfb+suRlUl5XHgLbUtdJmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786428497; c=relaxed/simple; bh=LRVTw6UVPk4ak8Vq4dEY9x515efog92c99hQpyDs3tI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=nson9tZPV+ku4mmUvkyDE+nGBjn77cjiiYSp/o6f5bBb7t78O8/0wG6SqRzBwWHcyEkFmPflGQ7kMAK4JnpK2H3voPTLx9JhmUAJWmMfIptn++Txjwt9+hpCCOVj9eknLJ/Kdh+rRZv7SzIhQzLwY8lsrLuoZZDhZtsarm8lC+Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kPihsSCp; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kPihsSCp" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38e3efab7e0so563923a91.0 for ; Mon, 10 Aug 2026 23:08:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786428495; x=1787033295; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=vR52uawzwZ8pAdqGTT5PA/Xi2oVkVf3Ut5OWPXZVNig=; b=kPihsSCpj5TTYS1ibdWNCwatyzq27sPhgSopn9+NKUGFKjS6Zm0LsxEJSL5Ry7Sysz zc2IV8zDpQK/Ed/BLV1BYUVC2s/dDVAJBFIfFi+6mAgSmeXU2I81uNw7XfDY1IsYN/lB qUb9+148O8FCGq2mokUksEiGCsvN1UR1nAzQef9qKVPm8W0XSMRZTVKjUGlPd2GD5/IE UZzjDysf0+Ay26wO4kFeU4Evt4q2OZLzr6E0X5EuE3GBh5E+EHiabXpjbh3UrQ6INK8J +7rPMAV7Zb894me/Smmh4mSLtgLA8MMuRjh0aQ7hM53AIS/Gs7vp1J9aSFTE6intYiY/ aS/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786428495; x=1787033295; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vR52uawzwZ8pAdqGTT5PA/Xi2oVkVf3Ut5OWPXZVNig=; b=RINw0gsDHRymh/rbLYzec/ju6rnvm5RqXZ47P8JFpoRo9iioYrAjNYpSl30A6UK1l5 eQVPsrUrvjnbytmhHOwWdaai6+hhAQ6jQtACBDdLBgw2JSUHuPgKCTrA6y387xGa7cFo snQdUqtq+KJ2o4XhxSyiGul4LT4JllXb1Uf8FKhWBuOgqydO5CVOqiRXFn+jK6VVy0jI p7nWPJl61u5N5rTufwOKgZIKBVZBKLq8fBcAmTOVqEfFfyIwl+2C+DrLGsDRcTLEC/WB qGsZfLEJFW1qvNCrnwsXDZsrNReURN6NVzk8KA6XFS7AqKDx+FyLXVy4amwDQr3Bg+mD sQDQ== X-Forwarded-Encrypted: i=1; AHgh+RrjwR3rQ1o+1wmpOT4HUX9YlufzyxuftJaZvXBiPfyaKcbq9KZs35AkIvwxRZYA4++gWpKroKdKbBW5g6M=@vger.kernel.org X-Gm-Message-State: AOJu0YyKP2h63943m3shWVdN1dtfyCeJZaZasv78YjA/1CEcxykOGsEZ b3/96rCmZ25jn8dJBZXgRYAvzfwiW0vRZpheHMsWM4fec9vK8Y4Lw0IByaPBFWuZ X-Gm-Gg: AR+sD11piuNEhuxxKagY142p7zoWRAG/d2K7TZQEJ0OgmGQZcVW1LTl0AwanI9DmtYL kdFXUDZFwVwXUHKFQWXu8W/NRSedYZRsYPg26rq/9ukluIgQgIlaANblHlQY0MEG1vGbZ65p5bI yP0ZMmtKVjIns9CG/djMtDxEwwQpTi61YXd+a5e6J+L4ta1XpWkZLxMGKYTTQSSra4trdtyAwZh fWjiXlIMzG2vC+zK26hHTtMCIGiruopnI2gbb3QkiBhfeVu7KtQnwIaV+GU7XzPGiWVoGI0xIkA 0oyhaMeqClgnsz4stDSxRplebYWGW+/zH7xKiHXOLMstP7BfIEC8y/p9pAO5PBEx8CjnoBn5G7R nutiK+lKL+66r7UmLMoFqvdXh5gMYDvI3fyryWMn2+OnetkuNqZeH33vcZl2+4U1RvCZMU0Nq9d 0fNqmbSiV3o3vQ+n1smlGT0QGPCtsJ5mGqZYsxneBqBEcoUBKBHeON1WaPKihxEDqFQyJSPlDnP xwLjVFF0ftuswJVE1KuNkz8 X-Received: by 2002:a17:90b:3805:b0:38e:9784:dd47 with SMTP id 98e67ed59e1d1-392ed01a8b1mr419591a91.1.1786428495466; Mon, 10 Aug 2026 23:08:15 -0700 (PDT) Received: from ML-GYSUBT565.ECARX.COM.CN ([101.47.164.95]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-14120460574sm1750218c88.15.2026.08.10.23.08.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 23:08:14 -0700 (PDT) From: Nguyen Quang Le Kien To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+8496ab5e117502750445@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: fix refcount underflow in gadgetfs_bind() error path Date: Tue, 11 Aug 2026 14:08:10 +0800 Message-Id: <20260811060810.295666-1-khiemtranzo532001@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" gadgetfs_bind() calls get_dev() only on the success path, but gadgetfs_unbind() called from the enomem error label unconditionally calls put_dev(). When bind fails (e.g. ENOMEM), put_dev() fires without a matching get_dev(), leaving the refcount unbalanced. A subsequent close of the ep0 file descriptor calls dev_release() -> put_dev() which hits zero and frees the object; then gadgetfs_kill_sb() calls put_dev(the_device) again on the already-freed pointer, triggering a refcount underflow and use-after-free. Fix by calling get_dev() at the start of gadgetfs_bind(), before any error path that invokes gadgetfs_unbind(), so the reference is always balanced regardless of whether bind succeeds or fails. Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D8496ab5e117502750445 Signed-off-by: Nguyen Quang Le Kien Reviewed-by: Alan Stern --- drivers/usb/gadget/legacy/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/= inode.c index d87a8ab51..d6551a4ce 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1682,6 +1682,8 @@ static int gadgetfs_bind(struct usb_gadget *gadget, dev->gadget =3D gadget; gadget->ep0->driver_data =3D dev; =20 + get_dev (dev); + /* preallocate control response and buffer */ dev->req =3D usb_ep_alloc_request (gadget->ep0, GFP_KERNEL); if (!dev->req) @@ -1696,7 +1698,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget, spin_lock_irq(&dev->lock); dev->state =3D STATE_DEV_UNCONNECTED; spin_unlock_irq(&dev->lock); - get_dev (dev); return 0; =20 enomem: --=20 2.34.1