* [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
@ 2026-08-04 9:52 Pei Xiao
2026-08-05 1:06 ` Thinh Nguyen
0 siblings, 1 reply; 3+ messages in thread
From: Pei Xiao @ 2026-08-04 9:52 UTC (permalink / raw)
To: Thinh.Nguyen, gregkh, linux-usb, linux-kernel; +Cc: Pei Xiao
In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
event is received.
If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
the memory allocated for dep with kzalloc() is released by kfree(dep),
while the delayed work mentioned above may still be pending or
running. The sequence of operations that may lead to a UAF bug is as
follows:
CPU0 CPU1
| dwc3_thread_interrupt
| dwc3_endpoint_interrupt
| dwc3_gadget_endpoint_stream_event
| queue_delayed_work(system_percpu_wq,
| &dep->nostream_work)
dwc3_gadget_free_endpoints |
dwc3_free_trb_pool(dep) |
list_del(&dep->endpoint.ep_list) |
dwc3_debugfs_remove_endpoint_dir(dep) |
kfree(dep) |
// dep is freed |
| dwc3_nostream_work
| // use dep (use-after-free)
Fix it by canceling the delayed work before kfree(dep) in
dwc3_gadget_free_endpoints.
Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
Assisted-by: Codex:deepseek-v4-flash
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
drivers/usb/dwc3/gadget.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index fa0f16ffafef..fa944856f956 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
}
dwc3_debugfs_remove_endpoint_dir(dep);
+ cancel_delayed_work_sync(&dep->nostream_work);
kfree(dep);
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
2026-08-04 9:52 [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Pei Xiao
@ 2026-08-05 1:06 ` Thinh Nguyen
2026-08-05 1:32 ` Pei Xiao
0 siblings, 1 reply; 3+ messages in thread
From: Thinh Nguyen @ 2026-08-05 1:06 UTC (permalink / raw)
To: Pei Xiao
Cc: Thinh Nguyen, gregkh@linuxfoundation.org,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
On Tue, Aug 04, 2026, Pei Xiao wrote:
> In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
> dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
> this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
> event is received.
>
> If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
> the memory allocated for dep with kzalloc() is released by kfree(dep),
> while the delayed work mentioned above may still be pending or
> running. The sequence of operations that may lead to a UAF bug is as
> follows:
>
> CPU0 CPU1
>
> | dwc3_thread_interrupt
> | dwc3_endpoint_interrupt
> | dwc3_gadget_endpoint_stream_event
> | queue_delayed_work(system_percpu_wq,
> | &dep->nostream_work)
> dwc3_gadget_free_endpoints |
> dwc3_free_trb_pool(dep) |
> list_del(&dep->endpoint.ep_list) |
> dwc3_debugfs_remove_endpoint_dir(dep) |
> kfree(dep) |
> // dep is freed |
> | dwc3_nostream_work
> | // use dep (use-after-free)
>
> Fix it by canceling the delayed work before kfree(dep) in
> dwc3_gadget_free_endpoints.
>
> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
> Assisted-by: Codex:deepseek-v4-flash
Please include Cc tag to stable and this ack:
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Thanks,
Thinh
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> ---
> drivers/usb/dwc3/gadget.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index fa0f16ffafef..fa944856f956 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
> }
>
> dwc3_debugfs_remove_endpoint_dir(dep);
> + cancel_delayed_work_sync(&dep->nostream_work);
> kfree(dep);
> }
> }
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
2026-08-05 1:06 ` Thinh Nguyen
@ 2026-08-05 1:32 ` Pei Xiao
0 siblings, 0 replies; 3+ messages in thread
From: Pei Xiao @ 2026-08-05 1:32 UTC (permalink / raw)
To: Thinh Nguyen
Cc: gregkh@linuxfoundation.org, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
在 2026/8/5 09:06, Thinh Nguyen 写道:
> On Tue, Aug 04, 2026, Pei Xiao wrote:
>> In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
>> dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
>> this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
>> event is received.
>>
>> If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
>> the memory allocated for dep with kzalloc() is released by kfree(dep),
>> while the delayed work mentioned above may still be pending or
>> running. The sequence of operations that may lead to a UAF bug is as
>> follows:
>>
>> CPU0 CPU1
>>
>> | dwc3_thread_interrupt
>> | dwc3_endpoint_interrupt
>> | dwc3_gadget_endpoint_stream_event
>> | queue_delayed_work(system_percpu_wq,
>> | &dep->nostream_work)
>> dwc3_gadget_free_endpoints |
>> dwc3_free_trb_pool(dep) |
>> list_del(&dep->endpoint.ep_list) |
>> dwc3_debugfs_remove_endpoint_dir(dep) |
>> kfree(dep) |
>> // dep is freed |
>> | dwc3_nostream_work
>> | // use dep (use-after-free)
>>
>> Fix it by canceling the delayed work before kfree(dep) in
>> dwc3_gadget_free_endpoints.
>>
>> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
>> Assisted-by: Codex:deepseek-v4-flash
>
> Please include Cc tag to stable and this ack:
Thanks! I will send v2,and add this.
Pei.
>
> Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
>
> Thanks,
> Thinh
>
>> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
>> ---
>> drivers/usb/dwc3/gadget.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index fa0f16ffafef..fa944856f956 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> +++ b/drivers/usb/dwc3/gadget.c
>> @@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>> }
>>
>> dwc3_debugfs_remove_endpoint_dir(dep);
>> + cancel_delayed_work_sync(&dep->nostream_work);
>> kfree(dep);
>> }
>> }
>> --
>> 2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-05 1:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-04 9:52 [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Pei Xiao
2026-08-05 1:06 ` Thinh Nguyen
2026-08-05 1:32 ` Pei Xiao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox