Re: [PATCH v3] usb: raw_gadget: fix use-after-free when UDC is removed

On Tue, Aug 04, 2026 at 08:32:50PM +0530, Anuj Bolewar via B4 Relay wrote:
> From: Anuj Bolewar <[email protected]>
> 
> When the UDC is removed (e.g. dummy_hcd unbind via sysfs) while the raw
> gadget fd is still open, usb_del_gadget() destroys the gadget device
> and its name. raw_gadget keeps a dangling pointer in dev->gadget, and
> ioctls dereference it after releasing dev->lock, leading to a
> use-after-free in dev_err() when usb_ep_queue() fails.
> 
> Take a gadget reference in gadget_bind() and drop it in dev_free() so
> the gadget device and its name stay alive for as long as the fd is open
> and an ioctl may still dereference dev->gadget.

But bind/unbind have nothing to do with open/close.  bind/unbind track
the lifetime of a driver being bound to a device.  After unbind happens,
the driver CAN NOT touch the device at all.  That's not what you are
fixing here, you are attempting to keep a reference alive that you are
NOT allowed to keep alive, as it is gone.

> gadget_unbind() only
> marks the device as failed under dev->lock; the reference is dropped in
> dev_free(), which runs only after the fd is closed and no ioctl can be
> in flight.

Again, bind/unbind have nothing to do with open/close/ioctl.  This is
the "traditional" issue with char devices having their "backing device"
go away.  There are many different ways to solve this, none of which is
this patch at all.

So please, go back and rethink the lifetime rules here and do NOT rely
on a LLM to attempt to work it out as obviously it is totally getting it
incorrect.

thanks,

greg k-h