CVE-2021-47272

What it actually does

Dangling dwc->gadget pointer and unmapped DMA addresses are dereferenced inside dwc3_gadget_exit after dwc3_gadget_init fails during a peripheral-to-host mode switch, producing a use-after-free and kernel panic.

Why it matters to the business

Dual-role USB devices using the DWC3 controller with FunctionFS or ConfigFS gadgets can experience sudden kernel crashes and loss of USB functionality during mode transitions, leading to downtime and potential data loss on affected systems.

How an attack unfolds

An attacker with local access or control of userspace gadget configuration starts a FunctionFS gadget, forces a mode switch sequence that leaves a pending driver on the gadget_driver_pending_list, causes the subsequent init to fail, and then triggers the exit path that dereferences the now-invalid gadget pointer.

How to fix it

Apply the upstream fix that sets dwc->gadget to NULL on dwc3_gadget_init failure and adds an early return in dwc3_gadget_exit when the pointer is NULL; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Inspect the dwc3 gadget source for the NULL assignment in the init failure path and the pointer check at the start of dwc3_gadget_exit; confirm the running kernel contains these changes and test the documented mode-switch sequence without triggering a panic.

Typical attack path

1. Configure and bind a FunctionFS/ConfigFS gadget in peripheral mode
2. Switch DWC3 controller to host mode (pending driver placed on list)
3. Terminate the userspace FunctionFS application
4. Switch controller back to peripheral mode causing dwc3_gadget_init to fail
5. Switch controller to host mode again invoking dwc3_gadget_exit on invalid state

How to detect it

Search kernel logs and crash dumps for oops/panic traces containing dwc3_gadget_exit, usb_del_gadget, or dma_free_coherent calls during USB mode transitions; correlate with FunctionFS or ConfigFS gadget activity.

What your security team should do

• Prioritize kernel upgrade on all dual-role DWC3 systems
• Add kernel panic and USB mode-switch events to monitoring alerts
• Restrict unprivileged use of FunctionFS/ConfigFS gadgets until patches are deployed