Re: [PATCH RFC] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs

#syz upstream

On Wed, Jul 29, 2026 at 10:17=E2=80=AFAM 'syzbot' via
syzkaller-upstream-moderation
<[email protected]> wrote:
>
> A null-pointer dereference occurs in f_midi2_free_ep_reqs() when attempti=
ng
> to clean up an endpoint that was never initialized.
>
> When configuring the MIDI 2.0 gadget via configfs and setting the block
> direction to SNDRV_UMP_DIR_INPUT, the initialization of the midi1_ep_out
> endpoint is explicitly skipped during the gadget bind phase
> (f_midi2_bind()). As a result, the usb_ep->card field remains NULL.
>
> Later, when the host sets the alternate setting, f_midi2_set_alt()
> unconditionally stops both the IN and OUT endpoints by calling
> f_midi2_stop_eps(), which in turn calls f_midi2_free_ep_reqs() for both
> endpoints. When f_midi2_free_ep_reqs() is called for the uninitialized
> midi1_ep_out, it attempts to dereference usb_ep->card to determine the
> number of requests to free, leading to a crash.
>
> Fix this by using usb_ep->num_reqs instead of usb_ep->card->info.num_reqs
> in f_midi2_free_ep_reqs(). usb_ep->num_reqs is correctly set during
> f_midi2_init_ep() and remains 0 if the endpoint was never initialized,
> safely avoiding the loop. For consistency, apply the same change to
> f_midi2_alloc_ep_reqs().
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc00000000ee: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000770-0x0000000000000777]
> ...
> RIP: 0010:f_midi2_free_ep_reqs drivers/usb/gadget/function/f_midi2.c:1166
> [inline]
> RIP: 0010:f_midi2_stop_eps+0x28e/0x4d0
> drivers/usb/gadget/function/f_midi2.c:1246
> ...
> Call Trace:
>  <TASK>
>  f_midi2_set_alt+0x11c/0xf00 drivers/usb/gadget/function/f_midi2.c:1296
>  composite_setup+0x1ffd/0x3480 drivers/usb/gadget/composite.c:1933
>  configfs_composite_setup+0xbd/0x100 drivers/usb/gadget/configfs.c:1877
>
> Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function =
driver")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3Dbbb6dad313f4aaa8da6b
> Link: https://syzkaller.appspot.com/ai_job?id=3D8ce30b1a-8cf7-4e38-bcf7-1=
f69e6f6313f
> To: "Greg Kroah-Hartman" <[email protected]>
> To: <[email protected]>
> To: "Takashi Iwai" <[email protected]>
> Cc: "Christophe JAILLET" <[email protected]>
> Cc: "Kees Cook" <[email protected]>
> Cc: <[email protected]>
>
> ---
> diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/f=
unction/f_midi2.c
> index 19fdac024..5e54cf994 100644
> --- a/drivers/usb/gadget/function/f_midi2.c
> +++ b/drivers/usb/gadget/function/f_midi2.c
> @@ -1145,7 +1145,7 @@ static int f_midi2_alloc_ep_reqs(struct f_midi2_usb=
_ep *usb_ep)
>         if (!usb_ep->reqs)
>                 return -EINVAL;
>
> -       for (i =3D 0; i < midi2->info.num_reqs; i++) {
> +       for (i =3D 0; i < usb_ep->num_reqs; i++) {
>                 if (usb_ep->reqs[i].req)
>                         continue;
>                 usb_ep->reqs[i].req =3D alloc_ep_req(usb_ep->usb_ep,
> @@ -1160,10 +1160,9 @@ static int f_midi2_alloc_ep_reqs(struct f_midi2_us=
b_ep *usb_ep)
>  /* Free allocated requests */
>  static void f_midi2_free_ep_reqs(struct f_midi2_usb_ep *usb_ep)
>  {
> -       struct f_midi2 *midi2 =3D usb_ep->card;
>         int i;
>
> -       for (i =3D 0; i < midi2->info.num_reqs; i++) {
> +       for (i =3D 0; i < usb_ep->num_reqs; i++) {
>                 if (!usb_ep->reqs[i].req)
>                         continue;
>                 free_ep_req(usb_ep->usb_ep, usb_ep->reqs[i].req);
>
>
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated =
patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at [email protected].
>
> --
> You received this message because you are subscribed to the Google Groups=
 "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to [email protected].
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller=
-upstream-moderation/8e3a30ca-25ad-44cf-9fa2-b4d70f4572ab%40mail.kernel.org=
.