tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling

The `tpg->tpg_nexus` pointer in the USB Target driver is dynamically
managed and tied to userspace configuration via ConfigFS. It can be
NULL if the USB host sends requests before the nexus is fully
established or immediately after it is dropped.

Currently, functions like `bot_submit_command()` and the data
transfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately
dereference `tv_nexus->tvn_se_sess` without any validation. If a
malicious or misconfigured USB host sends a BOT (Bulk-Only Transport)
command during this race window, it triggers a NULL pointer
dereference, leading to a kernel panic (local DoS).

This exposes an inconsistent API usage within the module, as peer
functions like `usbg_submit_command()` and `bot_send_bad_response()`
correctly implement a NULL check for `tv_nexus` before proceeding.

Fix this by bringing consistency to the nexus handling. Add the
missing `if (!tv_nexus)` checks to the vulnerable BOT command and
request processing paths, aborting the command gracefully with an
error instead of crashing the system.

Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Cc: stable <stable@kernel.org>
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260219023834.17976-1-jiashengjiangcool@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Jiasheng Jiang and committed by
Greg Kroah-Hartman b9fde507 93cd0d66

+14
+14
drivers/usb/gadget/function/f_tcm.c
··· 1222 1222 se_cmd = &cmd->se_cmd; 1223 1223 tpg = cmd->fu->tpg; 1224 1224 tv_nexus = tpg->tpg_nexus; 1225 + if (!tv_nexus) { 1226 + struct usb_gadget *gadget = fuas_to_gadget(cmd->fu); 1227 + 1228 + dev_err(&gadget->dev, "Missing nexus, ignoring command\n"); 1229 + return; 1230 + } 1231 + 1225 1232 dir = get_cmd_dir(cmd->cmd_buf); 1226 1233 if (dir < 0) 1227 1234 goto out; ··· 1490 1483 se_cmd = &cmd->se_cmd; 1491 1484 tpg = cmd->fu->tpg; 1492 1485 tv_nexus = tpg->tpg_nexus; 1486 + if (!tv_nexus) { 1487 + struct usb_gadget *gadget = fuas_to_gadget(cmd->fu); 1488 + 1489 + dev_err(&gadget->dev, "Missing nexus, ignoring command\n"); 1490 + return; 1491 + } 1492 + 1493 1493 dir = get_cmd_dir(cmd->cmd_buf); 1494 1494 if (dir < 0) 1495 1495 goto out;