From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0988E3515D2; Fri, 4 Sep 2026 05:09:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788498555; cv=none; b=WTCrBqIrMJv4Z4lk+wJicckH3nl8IY2YmGuEQT+83eVbyHeM0cPe3ynutc+Jd3lcFFvWPN+2zKozUu/Zl8lZ3l+YFNEpqgpejxr/FrL50XWAWoL5omb9fFt+yoKIrRUcuSD3J1FzKktCPzQm3fBt65zis2R1xybJ6fzA7vAhF+g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788498555; c=relaxed/simple; bh=fWxuUcH7u+y2lT5SIQ6kq/jwu+Q4A/ZS7dx3lyuNfws=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=akSm/bqZb9xpEZ4FVlcSLxfqHYxIJsQXD+UhoV/Bu5FqVtNFwPTcBg5N6EmN7679yjGtrIZYdpiMog1EH/O02QvNL2GH2x0Q0EmiHsPpuTq6HXrdDhzrrmWfG31cvOZPhLIkWPhANxU97NnSGnhLIXIQOi8Pq6EhcWra7x5mGwE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yLkpPDIE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yLkpPDIE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12F1D1F00A3D; Fri, 4 Sep 2026 05:09:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788498553; bh=HPB0QYackso/4VxxYguCNESzxMxiCFowTziuKIJHSqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yLkpPDIEdfDwriQQp/ipDKd3pPmBDpiAauLpxGfa2IxS5GmFCeWHSw9cm5uV/NiYQ 0EqK5Goy2n2MSFP3bwnz/0jq+JyRn+slUONeoRzrEvEx5cs+sMuiII1d+8zTpygm5V TyFGQ2g4+S5iWW1IHsfFd5ddmZ+yX2i5BrT29mrY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Thinh Nguyen , Pei Xiao , Radhey Shyam Pandey Subject: [PATCH 7.2 104/713] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition Date: Fri, 4 Sep 2026 06:51:12 +0200 Message-ID: <20260904045806.165863817@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045803.810145556@linuxfoundation.org> References: <20260904045803.810145556@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pei Xiao commit 9c855832790cd488d87de1885974f4c37cfe7358 upstream. In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM event is received. If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and the memory allocated for dep with kzalloc() is released by kfree(dep), while the delayed work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | dwc3_thread_interrupt | dwc3_endpoint_interrupt | dwc3_gadget_endpoint_stream_event | queue_delayed_work(system_percpu_wq, | &dep->nostream_work) dwc3_gadget_free_endpoints | dwc3_free_trb_pool(dep) | list_del(&dep->endpoint.ep_list) | dwc3_debugfs_remove_endpoint_dir(dep) | kfree(dep) | // dep is freed | | dwc3_nostream_work | // use dep (use-after-free) Fix it by canceling the delayed work before kfree(dep) in dwc3_gadget_free_endpoints. Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior") Assisted-by: Codex:deepseek-v4-flash Acked-by: Thinh Nguyen Cc: stable@vger.kernel.org Signed-off-by: Pei Xiao Reviewed-by: Radhey Shyam Pandey Link: https://patch.msgid.link/331d1d5133496d2b4184e05f8848adb06930a138.1785893865.git.xiaopei01@kylinos.cn Signed-off-by: Greg Kroah-Hartman --- drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -3497,6 +3497,7 @@ static void dwc3_gadget_free_endpoints(s } dwc3_debugfs_remove_endpoint_dir(dep); + cancel_delayed_work_sync(&dep->nostream_work); kfree(dep); } }