[BUG] usb: f_hid: WARNING in usb_ep_enable for endpoint with maxpacket 0

[BUG] usb: f_hid: WARNING in usb_ep_enable for endpoint with maxpacket 0

[CJ]

 
Hi,


I am reporting a WARNING in the USB gadget endpoint-enable path reached from the
HID gadget function, triggered by a syzkaller reproducer.  The issue is
reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935
(v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts configfs, creates a gadget with a hid.usb0 function, links
it into a configuration, and then writes "dummy_udc.0" to the gadget's UDC
attribute.  That write drives the gadget bind on the dummy UDC and enables the
function's endpoints.


The console shows the message "usb_ep_enable: ep129 (ep1in-bulk) has maxpacket
0" followed by a WARNING at drivers/usb/gadget/udc/core.c:124 with RIP in
usb_ep_enable, on CPU 0 in the context of kworker/0:3.  The endpoint being
enabled carries a zero maximum packet size in its descriptor.


One possible cause is that the HID function builds its endpoint descriptor
without validating the packet size it derives from the configfs-provided
parameters, so a zero-sized endpoint descriptor reaches usb_ep_enable, which
warns on it.  This looks like a missing sanity check in the function's
descriptor setup rather than a UDC problem.  I should note that the target
console for this case is truncated immediately after the warning header, so the
caller frames on the target side could not be compared with the original report;
the warning text, the file, the function and the reproducer are the same, and I
am describing this as a likely recurrence on that basis.


This appears to be a recurrence of the syzbot issue whose external id is
5bd412baa2c4211bdc7a.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff)
symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x1ff)
write(r0, &(0x7f0000001600)='dummy_udc.0', 0xb)


console output: https://pastebin.com/raw/SJyGKJLk
kernel config: https://pastebin.com/raw/50Jsqb7m

Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,

Changjian