[PATCH usb-next v1] USB: gadget: Fix UAF on refcount inside gadgetfs_bind()

[PATCH usb-next v1] USB: gadget: Fix UAF on refcount inside gadgetfs_bind()

[Rafael Alejandro Diaz Cruz]

The UAF is triggered by the syzkaller reproducer which
forces kmalloc failure inside of usb_ep_alloc_request().

This will cause the following error path to execute:

if (!dev->req)
        goto enomem;
// ...

enomem:
	gadgetfs_unbind (gadget);
	return -ENOMEM;

In normal case, get_dev() will be called to increment
refcounter from gadget->dev->count but in error case,
this increment is skipped and gadgetfs_unbind() will
decrement it via put_dev().

Going down the error path leads to a refcount imbalance
which will cause UAF in close()/umount() operations
due to refcount dropping below 0.

Fix this by moving get_dev() above the error paths so
that refcounter is incremented before the put_dev()
call.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 3e2bce7543d4..181b19e7fc2f 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1679,6 +1679,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	}
 
 	set_gadget_data (gadget, dev);
+	get_dev(dev);
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
 
@@ -1696,7 +1697,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:
-- 
2.43.0

Re: [PATCH usb-next v1] USB: gadget: Fix UAF on refcount inside gadgetfs_bind()

[Alan Stern]

On Tue, Sep 01, 2026 at 10:21:37PM -0700, Rafael Alejandro Diaz Cruz wrote:
> The UAF is triggered by the syzkaller reproducer which
> forces kmalloc failure inside of usb_ep_alloc_request().
> 
> This will cause the following error path to execute:
> 
> if (!dev->req)
>         goto enomem;
> // ...
> 
> enomem:
> 	gadgetfs_unbind (gadget);
> 	return -ENOMEM;
> 
> In normal case, get_dev() will be called to increment
> refcounter from gadget->dev->count but in error case,
> this increment is skipped and gadgetfs_unbind() will
> decrement it via put_dev().
> 
> Going down the error path leads to a refcount imbalance
> which will cause UAF in close()/umount() operations
> due to refcount dropping below 0.
> 
> Fix this by moving get_dev() above the error paths so
> that refcounter is incremented before the put_dev()
> call.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+4a5c87a01894ca37f25c@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=4a5c87a01894ca37f25c
> Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
> ---

Reviewed-by: Alan Stern <stern@rowland.harvard.edu>

But same comments as for the first patch.

Alan Stern

>  drivers/usb/gadget/legacy/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index 3e2bce7543d4..181b19e7fc2f 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -1679,6 +1679,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  	}
>  
>  	set_gadget_data (gadget, dev);
> +	get_dev(dev);
>  	dev->gadget = gadget;
>  	gadget->ep0->driver_data = dev;
>  
> @@ -1696,7 +1697,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
>  	spin_lock_irq(&dev->lock);
>  	dev->state = STATE_DEV_UNCONNECTED;
>  	spin_unlock_irq(&dev->lock);
> -	get_dev (dev);
>  	return 0;
>  
>  enomem:
> -- 
> 2.43.0
> 
>