From nobody Mon Sep 28 06:38:06 2026 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBF15486B8E for ; Tue, 25 Aug 2026 17:14:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787678046; cv=none; b=V7siuRXtaZNHk3OSPy5r5dXWBK+1G3GATjBMENTp7+ruk5oBb9d4HYdpvlvICsNNBGIdqJcl4pB4DDKlkxHR/iAHP8IDTzc/OUe6A3gf1SUYQIYRXF2/UhvfatkO+KGgmWGEKPaCByWiqDKE35TgKSbL2cUh/+FF/0db6PG7d2E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787678046; c=relaxed/simple; bh=OpUMRyvqO2TDh2Ehviw+eNrQLEvp9w5X8kjywsJwnKo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SzdPMRJK13Q2jQG/vhxNv37/C1ytdZjGNqKbuPPDu+193QB7CaqU+n3187nQGgUUgyNm0KRQs/Exsr+YCi5kFbD2jm5H+ldwDpRs2kGaDQHQT8+2G5Ti3nW8O1OoR7NdonOlcHYiq4xo/PaYV9yz7V5kuGsCNtltJ2CAu58ulb0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Kbmr7+V5; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Kbmr7+V5" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8520161fdb9so98128b3a.3 for ; Tue, 25 Aug 2026 10:14:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787678044; x=1788282844; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=zoBAAmieSvGKn/+PaDydAv9C08pg8BuNAhdnqlHhZz4=; b=Kbmr7+V5uPLxviMFdv6Pczrh+v/Tl8QWZC3mfX3fc7+QTpL3cYzbSgyQjm4MaEtMdU ulVXYQ3XF00guvsbuz8EXG2pbjqLV9rNfUBY4JfK1qzWCnfzN+njoz1BhsPxNMKgvRn2 dnqOJFdTGGLsVXhqMU9p/9uuY/OJ0xvI9t3vNwEi8roT2IJe1IUudTsqt4+lVXOwUOyQ 69j4yV9JrJTRUvJB0/TFpS296S3nIH3R32f4dGVWwEfymLj62sG4e46e78jJvzot/Pi/ wNhLEdmtBtFbRhV5ib6uZ9tRIJcEqoSwPTvGAkes6SMkCmOqPbl7yTnst42a7SZchqWT bYeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787678044; x=1788282844; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zoBAAmieSvGKn/+PaDydAv9C08pg8BuNAhdnqlHhZz4=; b=T1bz3SnsULUpUbO3G+aA43eMhwsNGjHdJ4KBiGkTz4Y1HMt55W0vsDq/usPeK0bvcT baIeJA8lb5jHeX92b58n8rS5NEucGKKEwauiIsmjF5uEvfkBVbQJEEWHgJbrNx0MGnEB WonSzQo4EnVQ0Rs2tglyn0MZ3wu57MIoZp+f/Xjv70WHNLT+tLTiFtob8OUyq+xGkWvJ 30bEZ7q+HqpwncuiZXTydzwMFSSD9kpIQwi2bL5KWJFdTJr3hLGNvp73NUyXnXl3yLEp Vg93Q3M+rhdbj5/2ClxeIhHgtvG5TmU2KqV4VeaS4a7s7wlyc4Omw7RCHulMMZWkig9f 9FYg== X-Forwarded-Encrypted: i=1; AHgh+Roi+457gMuh0sH8XO+sPsFVJ1nU+t5M9E1VhmBS12cQ1GOpgdA/A/ReD8lZ1uIalASqfpGMgj7dydoyR80=@vger.kernel.org X-Gm-Message-State: AFuF++n49MgPJgR1y9x+1DYQQdFh8HeS/cCQxHo0KB19QVIeMa5mS4oL 34ZU1pH2ubIZZ7VuNJd4BafREs9fDc1XXfqe8w4LbkFq5wJsDmlMZP+G X-Gm-Gg: AR+sD12w+IfHHsVlxacy++DFtoAoVYIHxtR7c3vgYBlSyQtw4eMXVDde5v/opPbr5aM BH3eykwi3Rc0FHY4HysJ0oJER7DwICSPJNssOZQF/1Rb0BNRUMwfkuRkJgz+l/wlja0dxDwekz4 RRK+xs26B2oZukrb1/owue2Wp2uMCdnk+E2/EKjxo1Y6E2UMnWTyByIEeVE12FV5jUaFXYdS7L4 mIbsuWQNfnFC/d9N1Kt7r2ekdM/yqdP28y5/Il+FzlwNpyl8te1ceLjMo9JmPSRxYRurvZN2fK9 agD2Swk4BRc1kpCFCZXxzkEQ18eQsKXp3CmMBeFqfuHE8YrmGvdSmMtqysw8dwaNAf0Vjoww1ZG VEXY0LxWpQCzTHAW4YXoBgX2in1pMHABMtjhqM94ZYorCBpRmAFTrhPek6eW0GK0dZFhCUHYcyk rwOBc76SE8/+dvAM0Af8TSfOPKtxaa26chiznCaSMw1Kgr+O3LGurtep5dOxNUTklwFlgNm7jHm C3QiXFDiiBV9EHkQIDaUAYEj324K9NbUQ== X-Received: by 2002:a05:6a21:497:b0:3c0:278c:6a31 with SMTP id adf61e73a8af0-3cd9129966bmr18069644637.11.1787678043727; Tue, 25 Aug 2026 10:14:03 -0700 (PDT) Received: from localhost ([2409:40c4:13d:8046:4d30:e4cc:47a7:83a3]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141a8f20095sm664742c88.6.2026.08.25.10.14.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 10:14:02 -0700 (PDT) From: Lovekesh Solanki To: stern@rowland.harvard.edu Cc: jjy600901@snu.ac.kr, brauner@kernel.org, eulgyukim@snu.ac.kr, gregkh@linuxfoundation.org, jack@suse.cz, kees@kernel.org, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, mjguzik@gmail.com, viro@zeniv.linux.org.uk, stable@vger.kernel.org, Lovekesh Solanki Subject: [PATCH v2] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() Date: Tue, 25 Aug 2026 22:43:43 +0530 Message-ID: <20260825171343.459630-1-lovekeshsolanki00@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer=20 dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently. Cc: stable@vger.kernel.org Reported-by: Eulgyu Kim Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac= .kr/ Reported-by: Jaeyoung Chung Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac= .kr/ Signed-off-by: Lovekesh Solanki Reviewed-by: Alan Stern --- Changes in v2: - Fix Link tag pointing to wrong bug report. - Remove the unnecessary NULL check. - Reword commit message as per Alan's review. drivers/usb/gadget/legacy/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/= inode.c index d87a8ab51510..12819e8c265d 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1251,10 +1251,11 @@ ep0_poll (struct file *fd, poll_table *wait) static long gadget_dev_ioctl (struct file *fd, unsigned code, unsigned lon= g value) { struct dev_data *dev =3D fd->private_data; - struct usb_gadget *gadget =3D dev->gadget; + struct usb_gadget *gadget; long ret =3D -ENOTTY; =20 spin_lock_irq(&dev->lock); + gadget =3D dev->gadget; if (dev->state =3D=3D STATE_DEV_OPENED || dev->state =3D=3D STATE_DEV_UNBOUND) { /* Not bound to a UDC */ --=20 2.55.0