ffs_dmabuf_detach() and ffs_dmabuf_find_attachment() dereference ffs->gadget->dev.parent as their very first statement, without checking that ffs->gadget is non-NULL: static int ffs_dmabuf_detach(struct file *file, int fd) { ... struct device *dev = ffs->gadget->dev.parent; ffs->gadget is only set between functionfs_bind() and functionfs_unbind() (UDC bind/unbind). The epfile ioctls, however, are gated only on ffs->state == FFS_ACTIVE, which userspace reaches by writing the descriptors and strings and which is independent of the gadget lifetime: an FFS instance is FFS_ACTIVE before it has ever been bound to a UDC, and stays FFS_ACTIVE after unbind. So FUNCTIONFS_DMABUF_DETACH (and the DMABUF transfer path, through ffs_dmabuf_find_attachment()) can be issued while ffs->gadget is NULL, dereferencing NULL: BUG: kernel NULL pointer dereference, address: 00000000000000b0 RIP: 0010:ffs_epfile_ioctl+0x402/0x1700 __x64_sys_ioctl+0x120/0x170 do_syscall_64+0xf9/0x540 Reproduced by mounting functionfs, writing a descriptor+string blob so the state becomes FFS_ACTIVE without ever binding a UDC, then issuing FUNCTIONFS_DMABUF_DETACH on an endpoint file. ffs_dmabuf_attach() already guards this with "if (!gadget || !gadget->sg_supported) return -EPERM". Do the same in ffs_dmabuf_detach() and ffs_dmabuf_find_attachment() (the latter also covers ffs_dmabuf_transfer()): snapshot ffs->gadget, return -EPERM if it is NULL, and use the snapshot. Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface") Cc: stable@vger.kernel.org Signed-off-by: Yu Zhang --- drivers/usb/gadget/function/f_fs.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 44218be..0976db7 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1473,9 +1473,15 @@ static int ffs_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock) static struct dma_buf_attachment * ffs_dmabuf_find_attachment(struct ffs_epfile *epfile, struct dma_buf *dmabuf) { - struct device *dev = epfile->ffs->gadget->dev.parent; + struct usb_gadget *gadget = epfile->ffs->gadget; struct dma_buf_attachment *attach = NULL; struct ffs_dmabuf_priv *priv; + struct device *dev; + + if (!gadget) + return ERR_PTR(-EPERM); + + dev = gadget->dev.parent; mutex_lock(&epfile->dmabufs_mutex); @@ -1570,11 +1576,17 @@ static int ffs_dmabuf_detach(struct file *file, int fd) { struct ffs_epfile *epfile = file->private_data; struct ffs_data *ffs = epfile->ffs; - struct device *dev = ffs->gadget->dev.parent; + struct usb_gadget *gadget = ffs->gadget; struct ffs_dmabuf_priv *priv, *tmp; struct dma_buf *dmabuf; + struct device *dev; int ret = -EPERM; + if (!gadget) + return -EPERM; + + dev = gadget->dev.parent; + dmabuf = dma_buf_get(fd); if (IS_ERR(dmabuf)) return PTR_ERR(dmabuf); -- 2.43.0