[PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Liu Chao]

raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
fails, or if the subsequent usb_ep_alloc_request() fails, the error
path frees desc via out_free but leaves ep->ep->desc pointing at the
freed memory.

The UDC driver may have captured the stale descriptor pointer during
the partial enable sequence and may dereference it in subsequent
operations, resulting in a use-after-free.

Clear ep->ep->desc before jumping to out_free on both failure paths
so the pointer never outlives the descriptor it references.

Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index 46f343ba4..b52ab3ce7 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 		if (ret < 0) {
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_enable returned %d\n", ret);
+			ep->ep->desc = NULL;
 			goto out_free;
 		}
 		ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
@@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_alloc_request failed\n");
 			usb_ep_disable(ep->ep);
+			ep->ep->desc = NULL;
 			ret = -ENOMEM;
 			goto out_free;
 		}
--
2.50.1

Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Greg KH]

On Tue, Oct 27, 2026 at 11:23:23AM +0800, Liu Chao wrote:
> raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
> to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
> fails, or if the subsequent usb_ep_alloc_request() fails, the error
> path frees desc via out_free but leaves ep->ep->desc pointing at the
> freed memory.
> 
> The UDC driver may have captured the stale descriptor pointer during
> the partial enable sequence and may dereference it in subsequent
> operations, resulting in a use-after-free.
> 
> Clear ep->ep->desc before jumping to out_free on both failure paths
> so the pointer never outlives the descriptor it references.
> 
> Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
> Cc: stable@vger.kernel.org
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
>  1 file changed, 2 insertions(+)

How was this found and tested?

thanks,

greg k-h

Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Liu Chao]

On Tue, Oct 27, 2026 at 06:58:44AM +0100, Greg KH wrote:
> How was this found and tested?

By code audit of the raw-gadget endpoint ownership, not from a crash report
or a fuzzer.

Reaching the failing path from userspace is straightforward.
usb_gadget_ep_match_desc() does not look at bDescriptorType, but dummy_hcd's
dummy_enable() does and rejects anything that is not USB_DT_ENDPOINT with
-EINVAL. So a single USB_RAW_IOCTL_EP_ENABLE with an otherwise valid
descriptor (0x81, bulk, 512 bytes, i.e. ep1in-bulk at high speed) and
bDescriptorType = 0 makes usb_ep_enable() fail and drops us into out_free:

  raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22

one line before kfree(desc), with ep->ep->desc still pointing at it.

Tested on mainline with CONFIG_USB_RAW_GADGET=y, CONFIG_USB_DUMMY_HCD=y and
KASAN, userspace side running in a QEMU guest: the descriptor gets freed and
ep->ep->desc keeps the stale value.

I could not find any in-tree reader of that pointer along this path, though.
usb_ep_enable() only reads a descriptor assigned right before it,
raw_process_ep_io() and the halt/wedge ioctls return early on the endpoint
state, and dummy_hcd keeps its own private descriptor pointer which
dummy_disable() clears, so the value left behind is only the core struct
usb_ep.desc. So a stock kernel stays silent under KASAN: as of today this is
a latent dangling reference, not a reachable crash. Reading the pointer from
a temporary probe patch (not part of the submission) right after the kfree()
gives:

  BUG: KASAN: slab-use-after-free in raw_ioctl
  Read of size 1 at 0xffff88800a7425a0 by task repro/71
  ...
  Allocated by task 71:
    memdup_user+0x26/0x80
    raw_ioctl+0xbfb/0x1ea0
  Freed by task 71:
    kfree+0x189/0x3b0
    raw_ioctl+0x1648/0x1ea0

and with the patch applied there is nothing left to read.

What makes it worth fixing anyway is that the stale pointer outlives the
file descriptor: a UDC's struct usb_ep is owned by the UDC, not by
raw_gadget, so the dangling value survives dev_free() and is still there for
whichever gadget driver binds that UDC next. The core keeps the opposite
invariant elsewhere -- usb_ep_autoconfig_ss() sets ep->desc = NULL,
composite.c assigns _ep->desc before enabling, and f_fs reads ep->ep->desc.

thanks,