usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
Published Sep 24, 2026
No CVSS score
EPSS 0.17%
Description
goku_irq() handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL ->driver:
if (dev->gadget.speed != USB_SPEED_UNKNOWN && dev->driver && dev->driver->resume) { spin_unlock(&dev->lock); dev->driver->resume(&dev->gadget); ... }
but the very next branch unconditionally dereferences dev->driver when an INT_USBRESET arrives:
if (stat & INT_USBRESET) { ACK(INT_USBRESET); INFO(dev, "USB reset done, gadget %s\n", dev->driver->driver.name); }
If the controller raises INT_USBRESET before any gadget driver has been bound (or after one has been unbound), dev->driver is NULL and the printk dereferences NULL.
smatch flags the inconsistency:
drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error: we previously assumed 'dev->driver' could be null (see line 1607)
Fall back to a placeholder when the gadget driver is not bound.
No functional change while a gadget driver is bound.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 2.6.12StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<2.6.12
- Version 5.10.271StatusunaffectedConstraints<=5.10.*
- Version 5.15.222StatusunaffectedConstraints<=5.15.*
- Version 6.1.189StatusunaffectedConstraints<=6.1.*
- Version 6.12.111StatusunaffectedConstraints<=6.12.*
- Version 6.18.53StatusunaffectedConstraints<=6.18.*
- Version 6.6.158StatusunaffectedConstraints<=6.6.*
- Version 7.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
No CWE recorded.
References (7)
- https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af
- https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae
- https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02
- https://git.kernel.org/stable/c/999ff3bf665f2abfb6af519ef3d6d42b061d3c15
- https://git.kernel.org/stable/c/a018d4195114ca2cf79858cc45c98581dee4795b
- https://git.kernel.org/stable/c/d7b33afbf9b54b61cb423af9663df54eae11d3b1
- https://git.kernel.org/stable/c/ea2901a4a90afc662e4d023542d91f10ab10fd3c
Change history (0)
No recorded changes yet.