From nobody Mon Sep 28 06:38:06 2026 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 100453D16FB for ; Tue, 25 Aug 2026 10:58:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787655488; cv=none; b=d7i7UXvj9hjNKvvDRELzlT5fKc1d4mZjbatEYK6TWQzd81e2sOQN+PVWCmRf+6zI5biGj/INqou3NYER+WL38gMkCVZ+cauklMjb79ebTmUhF0MdIfi2i3UDlbCy4THGpdBu/u6MPkbFGksWY0V0tqxBE6Yu8nFWhtQDWzv8iiE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787655488; c=relaxed/simple; bh=FPYe1crnsYHtn0U7WPNaYM9b5z0ifdW88rHUuc4KNhA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N1FrH+rvL84UmOex+mwgT1QCmZkxvNSbZdU83ray/fK8qro94hNyKQSREe0JicdLsFK6NJ2vDTDNLiOxghLniqWWYqNtMQJ1q3eiLd3H5fqWhW/eTVs4Qj17f8JPixOpBmpEbTeZiHzcVxxd+jFrGx3G5vN5eNs1bry6FVefbn0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=a7tUavtM; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="a7tUavtM" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc147d86bebso654643a12.0 for ; Tue, 25 Aug 2026 03:58:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787655486; x=1788260286; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ac16pfv2Rj18iPUVLOrADWTqxfqfViLMohr3+8pP5Us=; b=a7tUavtMS4NC1dzrg0HvxlNwLmjBJ0abt5zAmYDoVQqzMsB8fQyR+/JDF5r0zZlS6y ESq7RrFXVSTCSuLEMBnM6njhGpNi6gAzlOuDOl1DB1vsBau1/1ZLfvz289cwNmdDH90F vVn2+0zQ+tKou7b8BLFnflcIBHOYwOTL+3BfTRWZ7ZhRyEDzfOFKYz4flS12prMJjWiG J/VWU3AoIvcU+hd+dIv1izO4YuKqmesxtZNHCedLby9Wo+WRyCDsKJS0QAYOt8jMSh9N p48bWGuwgA6Nh6crUkvCxRtfPLS2juRJgXejgc5cwcCyuTMIX7aFjY20pDWW8QPZfrYB NQJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787655486; x=1788260286; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ac16pfv2Rj18iPUVLOrADWTqxfqfViLMohr3+8pP5Us=; b=S8n5EgQXbQ29692B1y7hI+VLdrPNNgkMpmDZCEwnBQMdZyKJzQiAqatQWrx6b1ph/b KLfwkP3b10wMVQfav3rQuHUOEDKYafHS3frtZ0OPD63NUZL12CrnfZZiPqEcOzAcPGRQ 6JHii+csh+Ukzs/TIiB7LQpjvWR8Lh5JybbD/Lg/FaS8WIaBfnOQqrDY/nnPlc6Hh8cl vbVcyTp7JqdtdHcgPnO0tBXDsf1LYbObJiKnNuIv494h9wMWad8LFx90Wq7DGKTUbaEg cFI85fzE3lBFZh/IxX/fYAZ71uwZ4s/e8eUvOfdypFNNSyIiLDuLE8phkVQs8r7Aw84Y 60Jw== X-Forwarded-Encrypted: i=1; AHgh+Rqg1Sbp8chd5zDQMisNWvzmxNC8DTg8Lo6u6QJohNTYbB52e/Z4Q4DN+zQFzOhWoC7WIN1zlBMDtSH/e/c=@vger.kernel.org X-Gm-Message-State: AFuF++nyaitwjzOgl3fq1RuWAGnp6AjtgJwzwKaaom0s/Eq2XHecC3wC xWKHjE6kRMd79kB//tQhOH2BFeMdYe2kza/ke3zFS6kZun/ZAiAqLle9 X-Gm-Gg: AR+sD11jvulfkq5A3PAadzee9nRHekkH8DrjsbLCaJuhdgOnEQN2QUTl3PC6t/xgEOY bErYCY5j1/9MfBOAeaQqLC0aPAAkBhQBJgNlKP7aHtNQy4dAdr2hOO9T2ypo2WgcUOSE4+xfgoo oJwa4g2umgcTPm7LzQhgLD00vIgFapkK3oWZtgFoLZeadvejqfXUqjns860RE6JZSfXRqlw0ZcL M5lVNHNR0Wy/HKEWS8dNmXHo+uJxpqpSeWg4mveUokBB9KRJBpy/KeUGRbV3spKeQQgBrjyp80W BKqSXNvAkbYP7oX9f4NbrIc0lmipZlGVt9MNYQJ2n3nUg0JxG4mlSv5t/aKG1SKcHU7pTE4Q67H CHB+2Aqr1LDMMRtCLRH8kbBl10nfyNWAhtFKAKRy3jpTRGyA4ThZNkzx8o/fDUW+O0Aikwm1vb3 xcqybrIVUgoeUBDDo0qRzBYTz+JIO9sS6UZjFUhPTZQZy0jFCnLos3nwaRJ3uMELXTVmTkfmMyk Y6qOl3M6S79iB4wtuY6yFGdjhIMkQd6fA== X-Received: by 2002:a17:90b:39a3:b0:36b:de66:92c3 with SMTP id 98e67ed59e1d1-39645a565e4mr7275293a91.10.1787655486061; Tue, 25 Aug 2026 03:58:06 -0700 (PDT) Received: from localhost ([2409:40c4:101c:e5a9:a28f:e499:1b07:43b3]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141860fe08csm53644630c88.8.2026.08.25.03.58.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 03:58:05 -0700 (PDT) From: Lovekesh Solanki To: jjy600901@snu.ac.kr Cc: brauner@kernel.org, eulgyukim@snu.ac.kr, gregkh@linuxfoundation.org, jack@suse.cz, kees@kernel.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, mjguzik@gmail.com, stern@rowland.harvard.edu, viro@zeniv.linux.org.uk, Lovekesh Solanki , stable@vger.kernel.org Subject: [PATCH] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Date: Tue, 25 Aug 2026 16:28:01 +0530 Message-ID: <20260825105801.319997-1-lovekeshsolanki00@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260824113510.1141236-1-jjy600901@snu.ac.kr> References: <20260824113510.1141236-1-jjy600901@snu.ac.kr> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" gadget_dev_ioctl() reads dev->gadget outside the dev->lock, while gadgetfs_bind() writes it without holding the lock. A concurrent bind can update dev->gadget and dev->state under the lock while the ioctl thread holds a stale NULL copy, causing a NULL pointer dereference at offset 0x28 (gadget->ops->ioctl). Read dev->gadget inside the locked region, before the state check, so the state and gadget pointer are always consistent. Cc: stable@vger.kernel.org Reported-by: Eulgyu Kim Link: https://lore.kernel.org/all/20260824160022.2378192-1-jjy600901@snu.ac= .kr/ Reported-by: Jaeyoung Chung Link: https://lore.kernel.org/all/20260824160022.2378192-1-jjy600901@snu.ac= .kr/ Signed-off-by: Lovekesh Solanki --- drivers/usb/gadget/legacy/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/= inode.c index d87a8ab51510..e9f7d7c1a6a3 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1251,14 +1251,15 @@ ep0_poll (struct file *fd, poll_table *wait) static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned lon= g value) { struct dev_data *dev =3D fd->private_data; - struct usb_gadget *gadget =3D dev->gadget; + struct usb_gadget *gadget; long ret =3D -ENOTTY; =20 spin_lock_irq(&dev->lock); + gadget =3D dev->gadget; if (dev->state =3D=3D STATE_DEV_OPENED || dev->state =3D=3D STATE_DEV_UNBOUND) { /* Not bound to a UDC */ - } else if (gadget->ops->ioctl) { + } else if (gadget && gadget->ops->ioctl) { ++dev->udc_usage; spin_unlock_irq(&dev->lock); =20 --=20 2.55.0