Re: [PATCH] usb: gadget: udc-xilinx: Fix wild pointer dereference on empty EP0 queue

[sashiko-bot@kernel.org]

> From: Wang Haoran <haoranwangsec@gmail.com>
> 
> list_first_entry() does not return NULL when the list is empty; it
> returns the result of container_of() on the list head, i.e. a non-NULL
> wild pointer pointing into the enclosing struct xusb_ep rather than to
> a valid request. This was found by code audit.
> 
> xudc_ep0_out() and xudc_ep0_in() are reached from the endpoint 0
> interrupt handler xudc_ctrl_ep_handler() purely based on the hardware
> FIFO status bits, without checking whether ep0->queue actually holds a
> request. The queue can be empty at that point: the gadget driver's
> setup() callback may not queue a request for every control transfer
> stage, and xudc_done() removes the request once it completes, after
> which bus timing can raise another FIFO ready/free interrupt. The
> unconditional list_first_entry() then yields a wild pointer, and the
> subsequent accesses to req->usb_req.actual, req->usb_req.buf and
> req->usb_req.length read or write unrelated kernel memory, leading to
> memory corruption or a crash. On real hardware this is triggerable by
> an external USB host controlling the token timing. Note that the
> enqueue side __xudc_ep0_queue() already guards the same queue with
> list_empty(), which shows the queue can legitimately be empty; the
> dequeue side was simply missing the symmetric check.
> 
> Switch both functions to list_first_entry_or_null() and return early
> when no request is queued, mirroring the existing list_empty() guard
> on the enqueue side.
> 
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023073131.637062-1-lixicaicai@gmail.com?part=1