[PATCH RFC] usb: gadget: dummy_hcd: suppress bind attributes

The `dummy_hcd` module emulates both a USB Host Controller (HCD) and a USB
Device Controller (UDC). During initialization, it creates two separate
platform devices (`dummy_hcd` and `dummy_udc`) that share the same
underlying state (`struct dummy`).

Because these two drivers are tightly coupled and share the same state,
they are not designed to be unbound individually at runtime. If a user
unbinds the `dummy_hcd` driver via sysfs, it cleans up the host controller
and sets the shared pointers to `NULL`. However, the `dummy_udc` driver
remains bound and active. If a gadget driver is then bound to the
still-active UDC, it will attempt to access the shared state, resulting in
a null-pointer dereference:

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:dummy_set_selfpowered+0xbe/0x160
drivers/usb/gadget/udc/dummy_hcd.c:906
Call Trace:
 usb_gadget_set_selfpowered+0x75/0x260 drivers/usb/gadget/udc/core.c:578
 composite_dev_prepare+0x2fa/0x320 drivers/usb/gadget/composite.c:2440
 configfs_composite_bind+0xa5/0x1410 drivers/usb/gadget/configfs.c:1701
 gadget_bind_driver+0x2ca/0x9e0 drivers/usb/gadget/udc/core.c:1662

To fix this, prevent userspace from unbinding these drivers individually
via sysfs by setting `.suppress_bind_attrs = true` in their `struct
device_driver` definitions. This disables the bind/unbind sysfs attributes
for the drivers, ensuring that their shared state cannot be broken by
userspace, while still allowing the entire module to be safely unloaded
(which correctly unregisters the UDC before the HCD).

Fixes: d9b762510c18 ("[PATCH] USB dummy_hcd: Use separate pdevs for HC and UDC")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=5c0303816c30d2e621df
Link: https://syzkaller.appspot.com/ai_job?id=177fd65f-4a8c-4071-b38d-4645a071d2ae
To: "Greg Kroah-Hartman" <[email protected]>
To: <[email protected]>
To: "Alan Stern" <[email protected]>
Cc: <[email protected]>
Cc: "Jinchao Wang" <[email protected]>

---
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c0e40fa6d..415096835 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1180,6 +1180,7 @@ static struct platform_driver dummy_udc_driver = {
 	.resume		= dummy_udc_resume,
 	.driver		= {
 		.name	= gadget_name,
+		.suppress_bind_attrs = true,
 	},
 };
 
@@ -2802,6 +2803,7 @@ static struct platform_driver dummy_hcd_driver = {
 	.resume		= dummy_hcd_resume,
 	.driver		= {
 		.name	= driver_name,
+		.suppress_bind_attrs = true,
 	},
 };
 


base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at [email protected].