Re: [PATCH] usbip: vudc: reject submits after endpoint state changes

[Shuah Khan <skhan@linuxfoundation.org>]

On 10/8/26 12:37, tjdqudcks0424@naver.com wrote:
> From: Sung Byeongchan <tjdqudcks0424@naver.com>
> 
> v_recv_cmd_submit() looks up an endpoint under udc->lock, but drops the
> lock while it allocates the URB and receives the payload.  A gadget
> configuration change can disable or disable and re-enable that endpoint
> before the URB is queued.  The submit then carries stale endpoint state
> into asynchronous VUDC processing.  The confirmed failure dereferences a
> NULL urb->dev while logging a completion error and panics the kernel.
> 
> Give each VUDC endpoint a generation that changes on enable and disable.
> Snapshot the generation and immutable parsing fields during lookup, then
> recheck descriptor presence and generation under udc->lock immediately
> before adding the URB to urb_queue.  Reject a stale request with
> -ESHUTDOWN.
> 
> On a KASAN build at ff47652a4b66c067c765a7ad464d930b5a9367cc,
> normal enabled-endpoint, serialized-disable, and disable/re-enable
> stale-submit cases each passed three independent fresh-boot runs after the
> fix.  The stale case returned -ESHUTDOWN without a sanitizer report, and a
> following EP0 request succeeded after bounded reconnection.  The touched
> source is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where
> the patch also applies and builds cleanly.
> 
> The demonstrated impact is kernel/service denial of service.  No controlled
> write, information disclosure, RCE, or LPE was demonstrated.  The source
> reproducer and complete logs are available on request and are not included
> in this public report.
> 
> OpenAI Codex assisted source inspection, test design, patch drafting, and
> evidence organization.

Please explain how this problem can be reproduced and why this fix
masese sense?

thanks,
-- Shuah