[PATCH] usbip: vudc: fix NULL pointer dereference in vep_dequeue

[PATCH] usbip: vudc: fix NULL pointer dereference in vep_dequeue

[Jipa Alexandru-Ionut]

vep_dequeue() reads the udc from req->udc, but struct vrequest's udc
field is never assigned anywhere in the driver, so it is always NULL.
The following dereference of udc->driver then oopses.

vep_queue(), the symmetric path, correctly derives the udc from the
endpoint via ep_to_vudc(ep); vep_dequeue() must do the same.

This is only reached when a request is queued at the time of dequeue.
A FunctionFS gadget keeps OUT requests queued, so unbinding such a
gadget from a usbip-vudc UDC (ffs_func_unbind -> usb_ep_dequeue)
hits it and wedges the vudc subsystem.

Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
Cc: stable@vger.kernel.org
Signed-off-by: Jipa Alexandru-Ionut <jipaionut@gmail.com>
---
 drivers/usb/usbip/vudc_dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c
index 100000000000..100000000001 100644
--- a/drivers/usb/usbip/vudc_dev.c
+++ b/drivers/usb/usbip/vudc_dev.c
@@ -344,7 +344,7 @@ static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)

 	ep = to_vep(_ep);
 	req = to_vrequest(_req);
-	udc = req->udc;
+	udc = ep_to_vudc(ep);

 	if (!udc->driver)
 		return -ESHUTDOWN;
--
2.47.0

Re: [PATCH] usbip: vudc: fix NULL pointer dereference in vep_dequeue

[kernel test robot]

Hi Jipa,

kernel test robot noticed the following build warnings:

[auto build test WARNING on usb/usb-testing]
[also build test WARNING on usb/usb-next usb/usb-linus linus/master v7.1-rc7 next-20260611]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jipa-Alexandru-Ionut/usbip-vudc-fix-NULL-pointer-dereference-in-vep_dequeue/20260612-195006
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20260612114148.6849-1-jipaionut%40gmail.com
patch subject: [PATCH] usbip: vudc: fix NULL pointer dereference in vep_dequeue
config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20260613/202606130221.e57TS4Rk-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260613/202606130221.e57TS4Rk-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606130221.e57TS4Rk-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/usb/usbip/vudc_dev.c: In function 'vep_dequeue':
>> drivers/usb/usbip/vudc_dev.c:336:26: warning: variable 'req' set but not used [-Wunused-but-set-variable=]
     336 |         struct vrequest *req;
         |                          ^~~


vim +/req +336 drivers/usb/usbip/vudc_dev.c

b6a0ca11186759 Igor Kotrasinski     2016-03-08  332  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  333  static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
b6a0ca11186759 Igor Kotrasinski     2016-03-08  334  {
b6a0ca11186759 Igor Kotrasinski     2016-03-08  335  	struct vep *ep;
b6a0ca11186759 Igor Kotrasinski     2016-03-08 @336  	struct vrequest *req;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  337  	struct vudc *udc;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  338  	struct vrequest *lst;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  339  	unsigned long flags;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  340  	int ret = -EINVAL;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  341  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  342  	if (!_ep || !_req)
b6a0ca11186759 Igor Kotrasinski     2016-03-08  343  		return ret;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  344  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  345  	ep = to_vep(_ep);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  346  	req = to_vrequest(_req);
c21cd67cd337e6 Jipa Alexandru-Ionut 2026-06-12  347  	udc = ep_to_vudc(ep);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  348  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  349  	if (!udc->driver)
b6a0ca11186759 Igor Kotrasinski     2016-03-08  350  		return -ESHUTDOWN;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  351  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  352  	spin_lock_irqsave(&udc->lock, flags);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  353  	list_for_each_entry(lst, &ep->req_queue, req_entry) {
b6a0ca11186759 Igor Kotrasinski     2016-03-08  354  		if (&lst->req == _req) {
b6a0ca11186759 Igor Kotrasinski     2016-03-08  355  			list_del_init(&lst->req_entry);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  356  			_req->status = -ECONNRESET;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  357  			ret = 0;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  358  			break;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  359  		}
b6a0ca11186759 Igor Kotrasinski     2016-03-08  360  	}
b6a0ca11186759 Igor Kotrasinski     2016-03-08  361  	spin_unlock_irqrestore(&udc->lock, flags);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  362  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  363  	if (ret == 0)
b6a0ca11186759 Igor Kotrasinski     2016-03-08  364  		usb_gadget_giveback_request(_ep, _req);
b6a0ca11186759 Igor Kotrasinski     2016-03-08  365  
b6a0ca11186759 Igor Kotrasinski     2016-03-08  366  	return ret;
b6a0ca11186759 Igor Kotrasinski     2016-03-08  367  }
b6a0ca11186759 Igor Kotrasinski     2016-03-08  368  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki