From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E4A327603C for ; Mon, 10 Aug 2026 03:15:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786331742; cv=none; b=JHyevqmIlbNLa+3Y6bBXFMOPxg3+PtQBPyWyEeaFhzHk0utw2D1BcS8PJyH5FLzsn1okWkrR4+SxaL7/8Sm6ze/s/pcXPvi8QQ3kSnvAFKyUuUyAdK0RLn4trLqZyvMYkpWkgYobnLCokMgzlt2CuVT0IH+5TWtJtNMgN/50w4E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786331742; c=relaxed/simple; bh=LB0d/VY8q1rYbqc20EDD/H5QPqiNHXA+e4EscPXaiqQ=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=UYC7xURxo8VQRYY5bxF/fOy3SOXjBtmqXM/N+QcAr7jF1D/UGYF9dAI2IiGOKjtQ2DnU2XMkKGkEd9F80iUf5feClorlm9OGMHxOE+8oB627qKpRyyrZDx97MkX3cxM9rOKSCrKc6+ds44WYTbLV1HsPB6+p89T5CYyOKPEw+jE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=DYrux2wW; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="DYrux2wW" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786331731; bh=AwHGgeDTYP3RX94vtmuc0Zyh8Z/4o6nQD2bq0oMjqKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DYrux2wWxVRHumubTqTHxg4cGfJG8I4tqgf7r1TGN6dPVkFQ/dqoHPIEc6mGlo1e9 qBtyVixz8thF68Dmg0/nEY8gsbrEiJg8GlPMzGBcxjqWSO0MdZzHb2jmnC2DYIuJlK /OtD/RraN5wzBwpyiSfeQKMB+6G4jW+0dRWE010Y= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrsza53-0.qq.com (NewEsmtp) with SMTP id 3898687E; Mon, 10 Aug 2026 11:14:09 +0800 X-QQ-mid: xmsmtpt1786331649tzloscbn1 Message-ID: X-QQ-XMAILINFO: MJf32pulH481tYL0NQtJ544Is8OfXlmwiwDSWrbQ9/0smnFpiAEn5eFHPY67gt 1srj6iOr6/jB79nYJKAFlmAmnkIvenz5mcbFV/a0ejU+NywAj+ZcAn3kTPVaPT1lW7aJdumOK9GL M088RrPnPlZWrCO0tN4fYSBDgbfoWVpdDMkQGVRTvLdhwlMzRzvHZk5kok1MZ0sIIrVmblR6Z56k QkY77DwvMMClX7lIyk2mk0Np3G+jOSBFklxyZYg6g2ZVNLeuLlGTaTP5BB9dQGBh9wfxX5HoclT/ Obolmwpp2DTAxychIfD76wTGq8OBnS2uZM3+D6x4YO2pF5KhUpmoT1qKem2mXMVUSndDWS5bV0e9 BasxombA+/R/U5Of2VaGYcjFGxkyFw8eSMQQgp+j/g/X3eu1kFOpLVovxu66twNQBQg5OkVA2D1n gXxrk/dFWZTeeaMXjM2Ly53b0w1bShefZbXwzUPxbOA6AYgHTX8tKw7/ds3WeBYCB1SATfUJZJug shJG9K0yJSEk1LDIoDSGnM+9ZoEKQQFqaFQ6tXQNi5chELPY37MwfkoQHl73KhkmEYZxLXag7i6y zNRfFnn8D2Dkwe/NAlLDT8ze9eJtzr/5FVCHnSAT7nQ9IeXxHHgeeAQVxl6U0KyePV4YbbU/ZUpe 9hz3cLkUO+JxLbsLTtQTNlPF6dPL1l0MPNH/safFcN8kq+Tjn+rOqER5Y5hG6AKpVmlCOndvd3sk G89Czd5p2dC2HgBR966CDASe1uMdVfhULdHAOovYnb9ZH1O0v4TJbfWgIZJQXNzB9/wXrBzqIHn7 yeRiQukQ2eSgAH5DwLNyZnYCUuBYal0dbejTXunh1pEC9bCzLxlV4BJ9eFm+piO3+kLNsSTDGIrO fdFUlVI+JzE3kEOLzPkBgoytDV7fxgDfh4hjkoQhHsmlkBDmJbP+bP71Gdlq1qFCzkmHtY7YkKWV 5C5+3ShVjbbFM0QEQkHKyR19FXa6VTC73xkVX6yHgnUNyaNf9tgWFvmHzHjJw6VGyQDm7j9A/0WC 12pDLxqQ== X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: Edward Adam Davis To: syzbot+60740c6a17a5b5eb1f5a@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [usb?] memory leak in hidg_bind Date: Mon, 10 Aug 2026 11:14:10 +0800 X-OQ-MSGID: <20260810031409.53687-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6a78d160.01d0871a.3a0d52.0091.GAE@google.com> References: <6a78d160.01d0871a.3a0d52.0091.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 183a25f65ac8..ee7e250f8fd5 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -511,7 +511,6 @@ static void config_usb_cfg_unlink( } } mutex_unlock(&gi->lock); - WARN(1, "Unable to locate function to unbind\n"); } static const struct configfs_item_operations gadget_config_item_ops = { @@ -1593,12 +1592,7 @@ static void purge_configs_funcs(struct gadget_info *gi) list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) { list_move(&f->list, &cfg->func_list); - if (f->unbind) { - dev_dbg(&gi->cdev.gadget->dev, - "unbind function '%s'/%p\n", - f->name, f); - f->unbind(c, f); - } + usb_remove_function(c, f); } c->next_interface_id = 0; memset(c->interface, 0, sizeof(c->interface)); diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c index 3c6b43d06a6d..0799220aeb13 100644 --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -1158,13 +1158,15 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) hidg->get_req->zero = 0; hidg->get_req->complete = hidg_get_report_complete; hidg->get_req->context = hidg; - hidg->get_report_returned = true; + hidg->get_report_returned = false; /* maybe allocate device-global string IDs, and patch descriptors */ us = usb_gstrings_attach(c->cdev, ct_func_strings, ARRAY_SIZE(ct_func_string_defs)); - if (IS_ERR(us)) - return PTR_ERR(us); + if (IS_ERR(us)) { + status = PTR_ERR(us); + goto fail; + } hidg_interface_desc.iInterface = us[CT_FUNC_HID_IDX].id; /* allocate instance-specific interface IDs, and patch descriptors */