From nobody Tue Sep 29 01:18:29 2026 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85EBC3C2BB0 for ; Thu, 13 Aug 2026 17:43:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786643016; cv=none; b=EVH0FzgDVPcu0eX0KlaPydtr90C1gX2Tund4Mtm7kWghCW6HqlV/K/wvMMAx5MbLBnbqS/y2olmXV6kARL1IU+qb8pW9WH8HIHUM+DmGSH35wnSYTD14/y1S9ZG+t6p5KwkGgZsPw7pYyAoqbj8UIUy00djsrcdujmfKgvyTHoA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786643016; c=relaxed/simple; bh=3Bp/wiO74y4rVmIS1HLOq7vys5FAwtoPCVF8zj3hR3w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FpHWYmHfaRGbxOSRQI/PeYWcq0bPcC/gND4SsOfnAKlF3x3F1OCx9MOcQnKIRnhEOXg8kN6FgXzVaGLJohZD0eL+smykJi76DhTz+ZLi+tzrGYCxRSSux5ywbIVZ+bRy1jfZg3bh4KwrhNB0ZiJWv4HXCEXYTcHnj/ISu+u3/YQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=stG9zfJd; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="stG9zfJd" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c9d1fff21edso49867a12.1 for ; Thu, 13 Aug 2026 10:43:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786643014; x=1787247814; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=0Weuf4GkCz4gjV3iqv4P06kigpBGcY4+7kCy4Zc1Nko=; b=stG9zfJdXqe2iNfAcjjpX5KPtTo5tR3aNvAw6/nAjDBiE9ajflF2gGdHFhYKrkya5g 9i/4Gk5+ZNWzEUHLsgc7O67H9N1PQTA1L6GP+0J18rVgudF7vSeJMak7JCHSi9Y1H/O6 zctD2NIpC+lwSm86fOg8fKNuoNfaMe1PtSK8wouXSPJgKfl94Mjki8bjM1Aqotj2ZECC 5b0J2KRiZamYL/W9LU/vgWMRnuwfd6PAejD24a5KCbVMP1y7RrlIR1K7nmmMynF4fXmP OwtnChSbPzyGXUtOCjaNVwdIBNTXSfmyDVQqV6eihNa2teOMiTYi8YtfNtuHz6zCylGa 1i3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786643014; x=1787247814; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0Weuf4GkCz4gjV3iqv4P06kigpBGcY4+7kCy4Zc1Nko=; b=glvc8y4U7DOpohzx37tnbsVexRaRKTF32YSZYti65rr+99UDcPiAvv0dAT0v9cA2jl CF+hXj4RyPrWCMb8lHOipbOWFogbEBatwml57FiptbJDHURmQTD+u8u5lF+U+xDrt1t8 l8iyYHERexHTZp0s8QA0l+CBSyj+P2wXYLUX100ye3zZAROBXl1M468sbt98IURDNIBH yImCY6vnG+tc3XOFcQW7Mfd4UGEL6yTXRl04KwTaQVZXuUnX3ozEIwNAITPNvkcdcNkb 6wrZtKTnu4HwirPNRziYQcwfx92rCAheuUvOiA0sMsIHaYt2hGAPmIjh2FV81ZzhKzFv liNA== X-Forwarded-Encrypted: i=1; AHgh+RrZ5bfa9AQoxT0+ICUUE+rKuewMOvVublEZ0yBRYOBxYmaO1u5Hw6eU64CRFugM+PgToMbMEKIQDMqCe3o=@vger.kernel.org X-Gm-Message-State: AOJu0YyNraoKR6dOIUUA1OYW55R7//PiiNY6bOoV4mlnMW2IOvGGqPwB 7L4rws9RFUIUMkLhIeGM2nJuMlkRsPgZT452j8P4YVDAHignUpsNc4DJOG6JW560 X-Gm-Gg: AR+sD13SQCLl/gIDzirD21M+6xTLySdR/F2OURT/L2jAKiKOxOU8wqeFVafeHA9epNd x6slTSzP+KhGkVtPOuBlGtj7oAUAU6hYfro0Z+x2pyLqIDPgkbsS9R2upZlDTFyt18YUzPMj1JM AUhZ7ieptPMGX2reEdI3FvCVi5mwjWgR7+l9dwojZy5jIypWWOC2rByB/qxIAFnxoHYkD1v9NmA cx8m8wwhQQ0eq/8PS0lyLn60sVEDvmF0/XTpsTnqi+52AqF6PeVLr93aTv+CnsVc5+J81TZzVsK TJ+ECxPY5BpMYDwXh8HpwETT+5n/hBqBH3Sb9a4CI23sCZDWZZOsKJX5symS3oV8KUOsNQw/45L FTLwEZUjKOITUgBT2uqQskM7uQjMOQbyd1YedZUENuKet7Lb4+NWmGeh5aguJmeKUW+dA5mxZtb mOuCGGZfj2lVIJOwxy4y329rcFX478/rHCBSpHKK/s5xNzcaNXS6/1f3I2PiJSC5zF X-Received: by 2002:a05:6a21:60c4:b0:3bf:b8d8:8296 with SMTP id adf61e73a8af0-3cc55488526mr10345897637.26.1786643013438; Thu, 13 Aug 2026 10:43:33 -0700 (PDT) Received: from Default ([2409:40f4:1003:e90b:67c1:9c95:4ba9:3e5]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31ebf732526sm8723722eec.19.2026.08.13.10.43.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 10:43:32 -0700 (PDT) From: Jeffin Philip To: gregkh@linuxfoundation.org Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, xu.yang_2@nxp.com, Frank.Li@nxp.com, kees@kernel.org, hhhuuu@google.com, jeffinphilip14@gmail.com, kai.aizen.dev@gmail.com, balbi@ti.com, bigeasy@linutronix.de, andrzej.p@samsung.com, laurent.pinchart@ideasonboard.com, syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com, stable@vger.kernel.org Subject: [PATCH] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Date: Thu, 13 Aug 2026 23:13:11 +0530 Message-ID: <20260813174311.130823-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind(). Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dde553c19cb054f174a35 Fixes: 0f9df9393855 ("usb: gadget: uvc: fix error path in uvc_function_bind= ()") Fixes: 6d11ed76c45d ("usb: gadget: f_uvc: convert f_uvc to new function int= erface") Cc: stable@vger.kernel.org Signed-off-by: Jeffin Philip --- drivers/usb/gadget/function/f_uvc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/funct= ion/f_uvc.c index 73dc7e42875f..d1bf3ea75197 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -889,9 +889,12 @@ uvc_function_bind(struct usb_configuration *c, struct = usb_function *f) v4l2_error: v4l2_device_unregister(&uvc->v4l2_dev); error: - if (uvc->control_req) + if (uvc->control_req) { usb_ep_free_request(cdev->gadget->ep0, uvc->control_req); + uvc->control_req =3D NULL; + } kfree(uvc->control_buf); + uvc->control_buf =3D NULL; =20 usb_free_all_descriptors(f); return ret; @@ -1075,7 +1078,9 @@ static void uvc_function_unbind(struct usb_configurat= ion *c, uvc->vdev_release_done =3D NULL; =20 usb_ep_free_request(cdev->gadget->ep0, uvc->control_req); + uvc->control_req =3D NULL; kfree(uvc->control_buf); + uvc->control_buf =3D NULL; =20 usb_free_all_descriptors(f); } --=20 2.55.0