Forwarded: [PATCH] usb: fix memory leak in dev_set_name

[syzbot <syzbot+87ce68d9f48eca96a84a@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] usb: fix memory leak in dev_set_name
Author: drifabdelmalekmohamedsaid@gmail.com

#syz test

diff --git a/drivers/usb/gadget/legacy/raw_gadget.c
b/drivers/usb/gadget/legacy/raw_gadget.c
index 4febf8dac7ca..9c263950f609 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -327,9 +327,16 @@ static int gadget_bind(struct usb_gadget *gadget,

 static void gadget_unbind(struct usb_gadget *gadget)
 {
+       unsigned long flags;
        struct raw_dev *dev = get_gadget_data(gadget);

        set_gadget_data(gadget, NULL);
+
+       /*Avoid dangling pointer in case it remaining references*/
+       spin_lock_irqsave(&dev->lock, flags);
+       dev->gadget = NULL;
+       spin_unlock_irqrestore(&dev->lock, flags);
+
        /* Matches kref_get() in gadget_bind(). */
        kref_put(&dev->count, dev_free);
 }