From: Liu Chao <liuc63@xiaopeng.com>
To: andreyknvl@gmail.com
Cc: gregkh@linuxfoundation.org, krishnagopi487@gmail.com,
kees@kernel.org, balbi@kernel.org, zhugl3@xiaopeng.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure
Date: Tue, 27 Oct 2026 11:23:23 +0800 [thread overview]
Message-ID: <20261027032332.1945140-1-liuc63@xiaopeng.com> (raw)
raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
fails, or if the subsequent usb_ep_alloc_request() fails, the error
path frees desc via out_free but leaves ep->ep->desc pointing at the
freed memory.
The UDC driver may have captured the stale descriptor pointer during
the partial enable sequence and may dereference it in subsequent
operations, resulting in a use-after-free.
Clear ep->ep->desc before jumping to out_free on both failure paths
so the pointer never outlives the descriptor it references.
Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index 46f343ba4..b52ab3ce7 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
if (ret < 0) {
dev_err(&dev->gadget->dev,
"fail, usb_ep_enable returned %d\n", ret);
+ ep->ep->desc = NULL;
goto out_free;
}
ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
@@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
dev_err(&dev->gadget->dev,
"fail, usb_ep_alloc_request failed\n");
usb_ep_disable(ep->ep);
+ ep->ep->desc = NULL;
ret = -ENOMEM;
goto out_free;
}
--
2.50.1
next reply other threads:[~2026-10-27 3:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 3:23 Liu Chao [this message]
2026-10-27 5:58 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027032332.1945140-1-liuc63@xiaopeng.com \
--to=liuc63@xiaopeng.com \
--cc=andreyknvl@gmail.com \
--cc=balbi@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=kees@kernel.org \
--cc=krishnagopi487@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=zhugl3@xiaopeng.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®