[PATCH] usbip: vudc: get vudc from endpoint in vep_dequeue

[PATCH] usbip: vudc: get vudc from endpoint in vep_dequeue

[Hu Xinyao]

vep_dequeue() looks up the virtual UDC through vrequest->udc, but
that field is never initialized when requests are allocated or queued.
A gadget function that dequeues a request during disconnect can
therefore dereference a NULL vudc pointer and crash the kernel.

This was observed with a USB/IP vUDC ACM gadget. ACM is not unique here;
it was only the tested gadget path. The bug is in the generic vUDC
dequeue path rather than in ACM itself.

Use the endpoint to recover the vudc, as the other vUDC endpoint ops
already do, instead of relying on the request-private field.

Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
Cc: stable@vger.kernel.org
Reported-by: Hu Xinyao <huxinyao0011@gmail.com>
Signed-off-by: Hu Xinyao <huxinyao0011@gmail.com>
---
 drivers/usb/usbip/vudc_dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c
index c5f079c5a1ea..f0a1a44c18e3 100644
--- a/drivers/usb/usbip/vudc_dev.c
+++ b/drivers/usb/usbip/vudc_dev.c
@@ -344,7 +344,7 @@ static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
 	ep = to_vep(_ep);
 	req = to_vrequest(_req);
-	udc = req->udc;
+	udc = ep_to_vudc(ep);
 
 	if (!udc->driver)
 		return -ESHUTDOWN;

base-commit: 186d3c4e92242351afc24d9784f31cb4cd08a4b7
-- 
2.53.0.windows.1

Re: [PATCH] usbip: vudc: get vudc from endpoint in vep_dequeue

[Greg KH]

On Mon, Jun 15, 2026 at 06:11:10PM +0800, Hu Xinyao wrote:
> vep_dequeue() looks up the virtual UDC through vrequest->udc, but
> that field is never initialized when requests are allocated or queued.
> A gadget function that dequeues a request during disconnect can
> therefore dereference a NULL vudc pointer and crash the kernel.
> 
> This was observed with a USB/IP vUDC ACM gadget. ACM is not unique here;
> it was only the tested gadget path. The bug is in the generic vUDC
> dequeue path rather than in ACM itself.
> 
> Use the endpoint to recover the vudc, as the other vUDC endpoint ops
> already do, instead of relying on the request-private field.
> 
> Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
> Cc: stable@vger.kernel.org
> Reported-by: Hu Xinyao <huxinyao0011@gmail.com>
> Signed-off-by: Hu Xinyao <huxinyao0011@gmail.com>

When you author and sign off on a patch, you don't need the reported-by
line.

Anyway, isn't this patch:
	https://lore.kernel.org/r/18A5F3B379FB205B+20260615093559.3436095-1-raoxu@uniontech.com
a better one instead?

thanks,

greg k-h