Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()
Greg Kroah-Hartman <[email protected]> Mon, 3 Aug 2026 11:15:48 +0200
| Newsgroups | org.kernel.vger.linux-usb,org.kernel.vger.stable |
|---|---|
| Message-ID | <2026080336-roast-sudden-e02e@gregkh> |
On Mon, Aug 03, 2026 at 12:12:58PM +0300, Dmitry Antipov wrote: > In 'gadgetfs_bind()', 'get_dev()' on appropriate 'struct dev_data' > instance should be performed immediately after the pointer is stored. > Otherwise an attempt to handle -ENOMEM later will issue an unbalanced > 'put_dev()' in 'gadgetfs_unbind()', thus leading to UAF errors. > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=6aa97991da41499aa852 > Cc: [email protected] > Signed-off-by: Dmitry Antipov <[email protected]> > --- > drivers/usb/gadget/legacy/inode.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) What commit id does this fix? thanks, greg k-h