CVE-2021-47272: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47272 affects the Linux kernel's USB DWC3 gadget driver. The vulnerability was discovered in the dwc3_gadget_exit() function where a NULL pointer dereference could occur during host-to-peripheral mode switching. The issue exists when dwc3_gadget_init() fails during a mode switch and a pending gadget driver fails to bind, leading to an invalid dwc->gadget pointer being referenced (Kernel Git).

The vulnerability occurs in a specific scenario involving the DWC3 USB controller's mode switching functionality. When switching from host to peripheral mode, if dwc3_gadget_init() fails while a pending gadget driver fails to bind, and then another mode switch occurs from peripheral to host mode, dwc3_gadget_exit() attempts to reference an invalid dwc->gadget pointer and calls dma_free_coherent() on unmapped DMA pointers. This can lead to a kernel panic (Kernel Git).

If exploited, this vulnerability could cause a kernel panic in systems using the affected Linux USB DWC3 driver, potentially leading to denial of service conditions. The issue specifically impacts systems that utilize USB device role switching functionality (Kernel Git).

The vulnerability can be triggered through a specific sequence of operations: starting DWC3 in peripheral mode, configuring ConfigFS gadget with FunctionFS, running a FunctionFS userspace application, binding the gadget driver, switching to host mode, stopping the FunctionFS application, and then performing additional mode switches. This makes it a relatively complex vulnerability to exploit but one that could be triggered through normal USB device operations (Kernel Git).

The issue has been fixed by adding a NULL pointer check in dwc3_gadget_exit() and properly handling the gadget pointer in the failure path of dwc3_gadget_init(). The fix involves setting dwc->gadget to NULL in the failure path and adding a check to bail out unless the gadget pointer is valid (Kernel Git).