Re: [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

[Thinh Nguyen <Thinh.Nguyen@synopsys.com>]

On Tue, Aug 04, 2026, Pei Xiao wrote:
> In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
> dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
> this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
> event is received.
> 
> If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
> the memory allocated for dep with kzalloc() is released by kfree(dep),
> while the delayed work mentioned above may still be pending or
> running. The sequence of operations that may lead to a UAF bug is as
> follows:
> 
> CPU0                                      CPU1
> 
>                                           | dwc3_thread_interrupt
>                                           | dwc3_endpoint_interrupt
>                                           | dwc3_gadget_endpoint_stream_event
>                                           | queue_delayed_work(system_percpu_wq,
>                                           |                    &dep->nostream_work)
> dwc3_gadget_free_endpoints                |
> dwc3_free_trb_pool(dep)                   |
> list_del(&dep->endpoint.ep_list)          |
> dwc3_debugfs_remove_endpoint_dir(dep)     |
> kfree(dep)                                |
> // dep is freed                           |
>                                           | dwc3_nostream_work
>                                           | // use dep (use-after-free)
> 
> Fix it by canceling the delayed work before kfree(dep) in
> dwc3_gadget_free_endpoints.
> 
> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
> Assisted-by: Codex:deepseek-v4-flash

Please include Cc tag to stable and this ack:

Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Thanks,
Thinh

> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> ---
>  drivers/usb/dwc3/gadget.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index fa0f16ffafef..fa944856f956 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>  		}
>  
>  		dwc3_debugfs_remove_endpoint_dir(dep);
> +		cancel_delayed_work_sync(&dep->nostream_work);
>  		kfree(dep);
>  	}
>  }
> -- 
> 2.25.1
>