[PATCH] usb: gadget: fix null pointer dereference in usb_put_function_instance()

[PATCH] usb: gadget: fix null pointer dereference in usb_put_function_instance()

[Jeffin Philip]

usb_put_function_instance() attempts to dereference fd inside fi struct
to get mod in uvc_alloc_inst() error path. However, fd is not allocated
until later in try_get_usb_function_instance() after allocating fi in
uvc_alloc_inst() and thus guranteed to be null in error path. Fix this
by adding a null check for fi->fd that returns if fd is null.

Reported-by: syzbot+fd6ef980cf1c722be639@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd6ef980cf1c722be639
Fixes: 0062f6e56f70 ("usb: gadget: add a forward pointer from usb_function to its "instance"")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
---
 drivers/usb/gadget/functions.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/functions.c b/drivers/usb/gadget/functions.c
index 203361a64212..70e31c40e267 100644
--- a/drivers/usb/gadget/functions.c
+++ b/drivers/usb/gadget/functions.c
@@ -70,7 +70,7 @@ void usb_put_function_instance(struct usb_function_instance *fi)
 {
 	struct module *mod;
 
-	if (!fi)
+	if (!fi || !fi->fd)
 		return;
 
 	mod = fi->fd->mod;
-- 
2.55.0

Re: [PATCH] usb: gadget: fix null pointer dereference in usb_put_function_instance()

[Jeffin Philip]

On Sun, 16 Aug 2026 11:47:12 +0530, Jeffin Philip wrote:

>usb_put_function_instance() attempts to dereference fd inside fi struct
>to get mod in uvc_alloc_inst() error path. However, fd is not allocated
>until later in try_get_usb_function_instance() after allocating fi in
>uvc_alloc_inst() and thus guranteed to be null in error path. Fix this
>by adding a null check for fi->fd that returns if fd is null.

Friendly ping, let me know if you want me to fix anything.

Thanks.
Jeffin.

Re: [PATCH] usb: gadget: fix null pointer dereference in usb_put_function_instance()

[Greg KH]

On Thu, Aug 27, 2026 at 10:07:46AM +0530, Jeffin Philip wrote:
> On Sun, 16 Aug 2026 11:47:12 +0530, Jeffin Philip wrote:
> 
> >usb_put_function_instance() attempts to dereference fd inside fi struct
> >to get mod in uvc_alloc_inst() error path. However, fd is not allocated
> >until later in try_get_usb_function_instance() after allocating fi in
> >uvc_alloc_inst() and thus guranteed to be null in error path. Fix this
> >by adding a null check for fi->fd that returns if fd is null.
> 
> Friendly ping, let me know if you want me to fix anything.

It's the middle of the merge window, we can't do anything until after
-rc1 is out.

In the meantime, please help review other patches on the list so that
yours rises to the top.

thanks,

greg k-h