[PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Liu Chao]

raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
fails, or if the subsequent usb_ep_alloc_request() fails, the error
path frees desc via out_free but leaves ep->ep->desc pointing at the
freed memory.

The UDC driver may have captured the stale descriptor pointer during
the partial enable sequence and may dereference it in subsequent
operations, resulting in a use-after-free.

Clear ep->ep->desc before jumping to out_free on both failure paths
so the pointer never outlives the descriptor it references.

Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index 46f343ba4..b52ab3ce7 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 		if (ret < 0) {
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_enable returned %d\n", ret);
+			ep->ep->desc = NULL;
 			goto out_free;
 		}
 		ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
@@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_alloc_request failed\n");
 			usb_ep_disable(ep->ep);
+			ep->ep->desc = NULL;
 			ret = -ENOMEM;
 			goto out_free;
 		}
--
2.50.1

Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Greg KH]

On Tue, Oct 27, 2026 at 11:23:23AM +0800, Liu Chao wrote:
> raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
> to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
> fails, or if the subsequent usb_ep_alloc_request() fails, the error
> path frees desc via out_free but leaves ep->ep->desc pointing at the
> freed memory.
> 
> The UDC driver may have captured the stale descriptor pointer during
> the partial enable sequence and may dereference it in subsequent
> operations, resulting in a use-after-free.
> 
> Clear ep->ep->desc before jumping to out_free on both failure paths
> so the pointer never outlives the descriptor it references.
> 
> Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
> Cc: stable@vger.kernel.org
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
>  1 file changed, 2 insertions(+)

How was this found and tested?

thanks,

greg k-h

Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Andrey Konovalov]

On Tue, Oct 27, 2026 at 4:23 AM Liu Chao <liuc63@xiaopeng.com> wrote:
>
> raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
> to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
> fails, or if the subsequent usb_ep_alloc_request() fails, the error
> path frees desc via out_free but leaves ep->ep->desc pointing at the
> freed memory.
>
> The UDC driver may have captured the stale descriptor pointer during
> the partial enable sequence and may dereference it in subsequent
> operations, resulting in a use-after-free.
>
> Clear ep->ep->desc before jumping to out_free on both failure paths
> so the pointer never outlives the descriptor it references.
>
> Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
> Cc: stable@vger.kernel.org
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
> index 46f343ba4..b52ab3ce7 100644
> --- a/drivers/usb/gadget/legacy/raw_gadget.c
> +++ b/drivers/usb/gadget/legacy/raw_gadget.c
> @@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
>                 if (ret < 0) {
>                         dev_err(&dev->gadget->dev,
>                                 "fail, usb_ep_enable returned %d\n", ret);
> +                       ep->ep->desc = NULL;
>                         goto out_free;
>                 }
>                 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
> @@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
>                         dev_err(&dev->gadget->dev,
>                                 "fail, usb_ep_alloc_request failed\n");
>                         usb_ep_disable(ep->ep);
> +                       ep->ep->desc = NULL;
>                         ret = -ENOMEM;
>                         goto out_free;
>                 }
> --
> 2.50.1
>

Commit message should ideally mention that the use-after-free is not
actually reachable.

But the clean-up makes sense:

Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>

Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Andrey Konovalov]

On Fri, Nov 6, 2026 at 1:43 AM Andrey Konovalov <andreyknvl@gmail.com> wrote:
>
> On Tue, Oct 27, 2026 at 4:23 AM Liu Chao <liuc63@xiaopeng.com> wrote:
> >
> > raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
> > to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
> > fails, or if the subsequent usb_ep_alloc_request() fails, the error
> > path frees desc via out_free but leaves ep->ep->desc pointing at the
> > freed memory.
> >
> > The UDC driver may have captured the stale descriptor pointer during
> > the partial enable sequence and may dereference it in subsequent
> > operations, resulting in a use-after-free.
> >
> > Clear ep->ep->desc before jumping to out_free on both failure paths
> > so the pointer never outlives the descriptor it references.
> >
> > Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
> > Cc: stable@vger.kernel.org
> > Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> > Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> > ---
> >  drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
> > index 46f343ba4..b52ab3ce7 100644
> > --- a/drivers/usb/gadget/legacy/raw_gadget.c
> > +++ b/drivers/usb/gadget/legacy/raw_gadget.c
> > @@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
> >                 if (ret < 0) {
> >                         dev_err(&dev->gadget->dev,
> >                                 "fail, usb_ep_enable returned %d\n", ret);
> > +                       ep->ep->desc = NULL;
> >                         goto out_free;
> >                 }
> >                 ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
> > @@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
> >                         dev_err(&dev->gadget->dev,
> >                                 "fail, usb_ep_alloc_request failed\n");
> >                         usb_ep_disable(ep->ep);
> > +                       ep->ep->desc = NULL;
> >                         ret = -ENOMEM;
> >                         goto out_free;
> >                 }
> > --
> > 2.50.1
> >
>
> Commit message should ideally mention that the use-after-free is not
> actually reachable.
>
> But the clean-up makes sense:
>
> Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>

Hm, looking at this more, it seems that the UDC drivers that care
about the value of ep->desc for disabled endpoints, NULL it out during
usb_ep_disable() themselves. And other gadget drivers also don't seem
to be NULLing out ep->desc explicitly. So I'm not sure if this
clean-up makes sense anymore. At least, until we get an actual
reproducer for a crash.