Re: [PATCH v2] usbip: vudc: reject submits after endpoint state changes

[Shuah Khan <skhan@linuxfoundation.org>]

On 10/20/26 12:18, tjdqudcks0424@naver.com wrote:
> From: Sung Byeongchan <tjdqudcks0424@naver.com>
> 
> v_recv_cmd_submit() looks up an endpoint under udc->lock, but drops the
> lock while it allocates the URB and receives the payload.  A gadget
> configuration change can disable or disable and re-enable that endpoint
> before the URB is queued.
> 
> In a timing-controlled KASAN test, one of six unmodified baseline runs
> faulted in the inlined receive path while reading endpoint descriptor
> state after the descriptor had been cleared.  The other baseline runs
> also showed that a submit could cross the endpoint state transition.
> 
> Give each VUDC endpoint a generation that changes on enable and disable.
> Snapshot the generation and immutable parsing fields during lookup, then
> recheck descriptor presence and generation under udc->lock immediately
> before adding the URB to urb_queue.  Reject a stale request with
> -ESHUTDOWN.
> 
> The parsing snapshots avoid unlocked reads of mutable descriptor state.
> The generation check also distinguishes a newly enabled endpoint from the
> old endpoint state even though both use the same struct vep.
> 
> On a KASAN build at ff47652a4b66c067c765a7ad464d930b5a9367cc,
> normal enabled-endpoint, serialized-disable, and disable/re-enable
> stale-submit cases each passed three independent fresh-boot runs after the
> fix.  The stale case returned -ESHUTDOWN without a sanitizer report, and a
> following EP0 request succeeded after bounded reconnection.  The touched
> source is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where
> the patch also applies and builds cleanly.
> 
> The demonstrated impact is kernel/service denial of service.  No
> controlled write, information disclosure, RCE, or LPE was demonstrated.

How did you reproduce it? If you didn't how are you sure this is the
right fix?

thanks,
-- Shuah