Re: [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

Greg Kroah-Hartman <[email protected]> Mon, 3 Aug 2026 11:15:48 +0200
Newsgroups org.kernel.vger.linux-usb,org.kernel.vger.stable
Message-ID <2026080336-roast-sudden-e02e@gregkh>
On Mon, Aug 03, 2026 at 12:12:58PM +0300, Dmitry Antipov wrote:
> In 'gadgetfs_bind()', 'get_dev()' on appropriate 'struct dev_data'
> instance should be performed immediately after the pointer is stored.
> Otherwise an attempt to handle -ENOMEM later will issue an unbalanced
> 'put_dev()' in 'gadgetfs_unbind()', thus leading to UAF errors.
> 
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=6aa97991da41499aa852
> Cc: [email protected]
> Signed-off-by: Dmitry Antipov <[email protected]>
> ---
>  drivers/usb/gadget/legacy/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

What commit id does this fix?

thanks,

greg k-h