Re: [PATCH v4] usb: gadget: u_serial: fix stale req->dep warn on disconnect/reconnect

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] usb: cdns3: use-after-free on request->buf in gadget giveback
--

commit 8f8778218c9b936c4a5d0fa16a09a9091afc687a
Author: Daehwan Jung <dh10.jung@samsung.com>

usb: gadget: u_serial: fix stale req->dep warn on disconnect/reconnect

When DWC3_EP_DELAY_STOP defers ENDXFER, giveback of -ESHUTDOWN requests
arrives after gserial_disconnect(). This commit frees the stale request
in gs_read_complete() when the port is already disconnected to prevent
subsequent warnings.

Link to v3: https://lore.kernel.org/all/20260727051335.1745955-1-dh10.jung@samsung.com/

> diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
> index cdd1dfc666c4f..ba6af7127fc47 100644
> --- a/drivers/usb/gadget/function/u_serial.c
> +++ b/drivers/usb/gadget/function/u_serial.c
> @@ -459,10 +459,21 @@ static void gs_read_complete(struct usb_ep *ep, struct usb_request *req)
>  {
>  	struct gs_port	*port = ep->driver_data;
>  
> -	/* Queue all received data until the tty layer is ready for it. */
>  	spin_lock(&port->port_lock);
> -	list_add_tail(&req->list, &port->read_queue);
> -	schedule_delayed_work(&port->push, 0);
> +	if (!port->port_usb) {
> +		/*
> +		 * The port was disconnected: gserial_disconnect() has already
> +		 * freed read_pool/read_queue and reset the request counters.
> +		 * Free this request now instead of queueing it, otherwise
> +		 * gs_rx_push() would return it to read_pool and the next
> +		 * gserial_connect() would submit it on the new OUT endpoint.
> +		 */
> +		gs_free_req(ep, req);

[Severity: High]
Does this cause a use-after-free when used with the cdns3 USB controller?

The cdns3 driver evaluates request->buf after calling the giveback handler:

drivers/usb/cdns3/cdns3-gadget.c:cdns3_gadget_giveback() {
    ...
		usb_gadget_giveback_request(&priv_ep->endpoint,
					    request);
		spin_lock(&priv_dev->lock);
	}

	if (request->buf == priv_dev->zlp_buf)
		cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);
    ...
}

If gs_read_complete() synchronously frees the request via gs_free_req() when
the port is disconnected, will the subsequent check in cdns3_gadget_giveback()
dereference the freed request pointer?

> +	} else {
> +		/* Queue all received data until the tty layer is ready for it. */
> +		list_add_tail(&req->list, &port->read_queue);
> +		schedule_delayed_work(&port->push, 0);
> +	}
>  	spin_unlock(&port->port_lock);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/1860250540.01791791282424.JavaMail.epsvc@epcpadp2new?part=1