{"id":"CVE-2021-47272","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -\u003e peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind.  Then, if the DRD undergoes\nanother mode switch from peripheral-\u003ehost the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc-\u003egadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3's UDC\n - Switch DWC3 to host mode\n   =\u003e dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n   =\u003e dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n   =\u003e dwc3_gadget_exit() is called again, but this time dwc-\u003egadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc-\u003egadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid.","modified":"2026-03-14T01:44:08.190360Z","published":"2024-05-21T15:15:15.687Z","references":[{"type":"FIX","url":"https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"},{"type":"FIX","url":"https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"},{"type":"FIX","url":"https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47272.json","unresolved_ranges":[{"events":[{"introduced":"5.10"},{"fixed":"5.10.44"}]},{"events":[{"introduced":"5.11"},{"fixed":"5.12.11"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc1"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc2"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc3"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc4"}]},{"events":[{"introduced":"0"},{"last_affected":"5.13-rc5"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}