In the Linux kernel, the following vulnerability has been resolved: USB: dummy-hcd: Fix locking/synchronization error Syzbot testing was able to provoke an addressing exception and crash in the usb_gadget_udc_reset() routine in drivers/usb/gadgets/udc/core.c, resulting from the fact that the routine was called with a second ("driver") argument of NULL. The bad caller was set_link_state() in dummy_hcd.c, and the problem arose because of a race between a USB reset and driver unbind. These sorts of races were not supposed to be possible.

commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), along with a few followup commits, was written specifically to prevent them. As it turns out, there are (at least) two errors remaining in the code. Another patch will address the second error.

this one is concerned with the first. The error responsible for the syzbot crash occurred because the stop_activity() routine will sometimes drop and then re-acquire the dum-lock spinlock. A call to stop_activity() occurs in set_link_state() when handling an emulated USB reset, after the test of dum-ints_enabled and before the increment of dum-callback_usage. This allowed another thread (doing a driver unbind) to sneak in and grab the spinlock, and then clear dum-ints_enabled and dum-driver. Normally this other thread would have to wait for dum-callback_usage to go down to 0 before it would clear dum-driver, but in this case it didn't have to wait since dum-callback_usage had not yet been incremented. The fix is to increment dum-callback_usage _before_ calling stop_activity() instead of after. Then the thread doing the unbind will not clear dum-driver until after the call to usb_gadget_udc_reset() safely returns and dum-callback_usage has been decremented again.