Re: [PATCH] usbip: vudc: snapshot endpoint state under lock

[Shuah Khan <skhan@linuxfoundation.org>]

On 10/7/26 00:30, Sung Byeongchan wrote:
> v_recv_cmd_submit() finds an endpoint and records its type while holding
> udc->lock, but then drops the lock and rereads both ep->type and ep->desc.
> The VUDC timer drops this lock around gadget setup callbacks, and
> endpoint disable clears ep->desc under the lock.  A USB/IP host can
> therefore race an ISO CMD_SUBMIT with endpoint disable and make
> usb_endpoint_maxp() dereference NULL.
> 
> Copy the endpoint type and derived isochronous maximum packet size while
> the lock still protects the descriptor.  Use the snapshots for
> validation, URB allocation, and pipe setup after unlocking.
> 
> This was found by source review with AI assistance.  The production VUDC
> and UAC2 fixture panicked in two independent boots without a diagnostic
> kernel change.  The fixed kernel completed 5,257 race attempts without
> an oops or panic and preserved the normal and serialized controls.

This change is incorrect to fix the problem you are describing. Can you
elaborate on how your testing method and environment in more detail?

thanks,
-- Shuah