For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: WARNING: refcount bug in trace_suspend_resume (2)
Author: khiemtranzo532001@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next
From 7793c39a61d25917c6047a9b7fb4d666bcc2b227 Mon Sep 17 00:00:00 2001
From: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
Date: Tue, 11 Aug 2026 12:46:21 +0800
Subject: [PATCH] usb: gadget: fix refcount underflow in gadgetfs_bind() error
path
gadgetfs_bind() calls get_dev() only on the success path, but
gadgetfs_unbind() called from the enomem error label unconditionally
calls put_dev(). When bind fails (e.g. ENOMEM), put_dev() fires
without a matching get_dev(), leaving the refcount unbalanced.
A subsequent close of the ep0 file descriptor calls dev_release() ->
put_dev() which hits zero and frees the object; then gadgetfs_kill_sb()
calls put_dev(the_device) again on the already-freed pointer, triggering
a refcount underflow and use-after-free.
Fix by calling get_dev() at the start of gadgetfs_bind(), before any
error path that invokes gadgetfs_unbind(), so the reference is always
balanced regardless of whether bind succeeds or fails.
Reported-by: syzbot+8496ab5e117502750445@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8496ab5e117502750445
Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@gmail.com>
---
drivers/usb/gadget/legacy/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51..d6551a4ce 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1682,6 +1682,8 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
dev->gadget = gadget;
gadget->ep0->driver_data = dev;
+ get_dev (dev);
+
/* preallocate control response and buffer */
dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
if (!dev->req)
@@ -1696,7 +1698,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
spin_lock_irq(&dev->lock);
dev->state = STATE_DEV_UNCONNECTED;
spin_unlock_irq(&dev->lock);
- get_dev (dev);
return 0;
enomem:
--
2.34.1