KASAN: slab-use-after-free Write in dev

Based on kernel commit e11160948333:

Technical Root Cause Analysis

1. Involved Subsystems and Entities

Source File: drivers/usb/gadget/legacy/inode.c
Functions: dev_config(), gadgetfs_bind(), gadgetfs_unbind(), put_dev(), get_dev()
Structs & Fields:
- struct dev_data: holds gadgetfs device state, including count (refcount_t), state (enum ep0_state), buf (void *), and gadget_registered (bool).
- gadgetfs_driver (struct usb_gadget_driver): legacy gadgetfs driver definition.

2. Root Cause Mechanism

The reported bug is a slab use-after-free write triggered when userspace writes configuration descriptors to /dev/gadget/$CHIP via dev_config():

Unbalanced Reference Dropping on gadgetfs_bind() Error: In drivers/usb/gadget/legacy/inode.c:1678, gadgetfs_bind() binds the gadget driver to the USB device controller (UDC). When gadgetfs_bind() succeeds, it acquires a reference to struct dev_data by calling get_dev(dev) at line 1709:
```
INFO (dev, "bound to %s driver\n", gadget->name);
spin_lock_irq(&dev->lock);
dev->state = STATE_DEV_UNCONNECTED;
spin_unlock_irq(&dev->lock);
get_dev (dev);
return 0;

enomem:
    gadgetfs_unbind (gadget);
    return -ENOMEM;
```
If an error occurs before line 1709—such as a failure in usb_ep_alloc_request() (line 1697) or activate_ep_files() (line 1702)—execution jumps to enomem: (line 1712), which invokes gadgetfs_unbind(gadget) at line 1713.

However, gadgetfs_unbind() unconditionally calls put_dev(dev) at line 1673:
```
static void
gadgetfs_unbind (struct usb_gadget *gadget)
{
    ...
    destroy_ep_files (dev);
    gadget->ep0->driver_data = NULL;
    set_gadget_data (gadget, NULL);
    if (dev->req)
        usb_ep_free_request (gadget->ep0, dev->req);
    DBG (dev, "%s done\n", __func__);
    put_dev (dev);
}
```
Because get_dev(dev) was never called prior to this error exit, gadgetfs_unbind() drops a reference that was never acquired.
premature Freeing of struct dev_data: When multiple UDCs match (e.g., gadget.0 and gadget.1), driver probe is attempted via bus_for_each_dev() in driver_register(). Each failed probe attempt calls gadgetfs_bind(), which through gadgetfs_unbind() drops an un-acquired reference. This decrements dev->count down to 0, causing put_dev() to call kfree(data):
```
static void put_dev (struct dev_data *data)
{
    if (likely (!refcount_dec_and_test (&data->count)))
        return;
    BUG_ON (waitqueue_active (&data->wait));
    kfree (data);
}
```
Driver Registration Returning 0 Despite Failed Bind: In dev_config(), driver registration is initiated via:
```
value = usb_gadget_register_driver(&gadgetfs_driver);
```
Inside usb_gadget_register_driver_owner() (drivers/usb/gadget/udc/core.c:1752):
- Probing devices on the bus fails with -ENOMEM (-12), logged as gadgetfs gadget.1: probe with driver gadgetfs failed with error -12.
- In Linux driver-core semantics, a probe failure does not make driver_register() fail (it returns 0).
- When checking whether the driver is bound (lines 1760–1770):
```
if (!driver->is_bound) {
    if (driver->match_existing_only) {
        pr_warn("%s: couldn't find an available UDC or it's busy\n",
                driver->function);
        ret = -EBUSY;
    } else {
        pr_info("%s: couldn't find an available UDC\n",
                driver->function);
        ret = 0;
    }
}
```
  Because gadgetfs_driver.match_existing_only is not set (false), the function logs UDC core: USB Gadget filesystem: couldn't find an available UDC and returns ret = 0.
Use-After-Free Write: Because usb_gadget_register_driver() returns 0, dev_config() proceeds to the success branch (inode.c:1897-1909):
```
value = usb_gadget_register_driver(&gadgetfs_driver);
if (value != 0) {
    spin_lock_irq(&dev->lock);
    goto fail;
} else {
    value = len;
    dev->gadget_registered = true;  /* <--- Use-after-free write */
}
```
At line 1908, it writes true (size 1) to dev->gadget_registered, but dev has already been freed by put_dev(), triggering the KASAN slab-use-after-free report.

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
3cc05b37	assessment-security	DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	KASAN: slab-use-after-free Write in dev_config	2026/11/06 00:03	2026/11/06 00:03	2026/11/06 00:34	5cecaf1f
c931428e	moderation	Actionable: ✅	❓	KASAN: slab-use-after-free Write in dev_config	2026/11/06 00:02	2026/11/06 00:03	2026/11/06 01:11	5cecaf1f
0491c8ca	moderation		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/28 00:00	2026/09/28 00:00	2026/09/28 00:00	a3c7249d
0674808e	repro-c		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/27 00:34	2026/09/27 00:34	2026/09/27 00:34	a3c7249d
630dc1ab	assessment-security		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/27 00:00	2026/09/27 00:00	2026/09/27 00:00	a3c7249d
286a3b55	moderation		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/26 00:00	2026/09/26 00:00	2026/09/26 00:00	f281d9d2
a0faf085	repro-c		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/25 01:19	2026/09/25 01:19	2026/09/25 01:19	3c3cdf19
87b71e5a	moderation		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/25 00:00	2026/09/25 00:00	2026/09/25 00:00	3c3cdf19
8d14ccaa	assessment-security		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/24 00:01	2026/09/24 00:01	2026/09/24 00:01	0a1606bc
95feed9c	assessment-security		💥	KASAN: slab-use-after-free Write in dev_config	2026/09/22 00:00	2026/09/22 00:00	2026/09/22 00:00	853b104b

assessment-security

DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ✅ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/09/20 03:37	git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next	e11160948333	853b104b	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu2-riscv64	KASAN: slab-use-after-free Write in dev_config
2026/09/20 03:36	git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next	e11160948333	853b104b	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu2-riscv64	KASAN: slab-use-after-free Write in dev_config