Re: [PATCH v2] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

["Pandey, Radhey Shyam" <radheys@amd.com>]

On 8/5/2026 7:10 AM, Pei Xiao wrote:
> In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
> dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
> this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
> event is received.
> 
> If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
> the memory allocated for dep with kzalloc() is released by kfree(dep),
> while the delayed work mentioned above may still be pending or
> running. The sequence of operations that may lead to a UAF bug is as
> follows:
> 
> CPU0                                      CPU1
> 
>                                            | dwc3_thread_interrupt
>                                            | dwc3_endpoint_interrupt
>                                            | dwc3_gadget_endpoint_stream_event
>                                            | queue_delayed_work(system_percpu_wq,
>                                            |                    &dep->nostream_work)
> dwc3_gadget_free_endpoints                |
> dwc3_free_trb_pool(dep)                   |
> list_del(&dep->endpoint.ep_list)          |
> dwc3_debugfs_remove_endpoint_dir(dep)     |
> kfree(dep)                                |
> // dep is freed                           |
>                                            | dwc3_nostream_work
>                                            | // use dep (use-after-free)
> 
> Fix it by canceling the delayed work before kfree(dep) in
> dwc3_gadget_free_endpoints.
> 
> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
> Assisted-by: Codex:deepseek-v4-flash
> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>

Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Thanks!> ---
> changes in v2:
> add Acked-by add Cc stable
> ---
>   drivers/usb/dwc3/gadget.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index fa0f16ffafef..fa944856f956 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>   		}
>   
>   		dwc3_debugfs_remove_endpoint_dir(dep);
> +		cancel_delayed_work_sync(&dep->nostream_work);
>   		kfree(dep);
>   	}
>   }