Re: [PATCH] usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

在 2026/8/5 09:06, Thinh Nguyen 写道:
> On Tue, Aug 04, 2026, Pei Xiao wrote:
>> In dwc3_gadget_init_endpoint, &dep->nostream_work is bound with
>> dwc3_nostream_work, and dwc3_gadget_endpoint_stream_event can queue
>> this delayed work on system_percpu_wq when a DEPEVT_STREAM_NOSTREAM
>> event is received.
>>
>> If we remove the gadget, dwc3_gadget_free_endpoints makes cleanup and
>> the memory allocated for dep with kzalloc() is released by kfree(dep),
>> while the delayed work mentioned above may still be pending or
>> running. The sequence of operations that may lead to a UAF bug is as
>> follows:
>>
>> CPU0                                      CPU1
>>
>>                                           | dwc3_thread_interrupt
>>                                           | dwc3_endpoint_interrupt
>>                                           | dwc3_gadget_endpoint_stream_event
>>                                           | queue_delayed_work(system_percpu_wq,
>>                                           |                    &dep->nostream_work)
>> dwc3_gadget_free_endpoints                |
>> dwc3_free_trb_pool(dep)                   |
>> list_del(&dep->endpoint.ep_list)          |
>> dwc3_debugfs_remove_endpoint_dir(dep)     |
>> kfree(dep)                                |
>> // dep is freed                           |
>>                                           | dwc3_nostream_work
>>                                           | // use dep (use-after-free)
>>
>> Fix it by canceling the delayed work before kfree(dep) in
>> dwc3_gadget_free_endpoints.
>>
>> Fixes: dcfe437492e2 ("usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior")
>> Assisted-by: Codex:deepseek-v4-flash
> 
> Please include Cc tag to stable and this ack:
Thanks! I will send v2,and add this.

Pei.
> 
> Acked-by: Thinh Nguyen <[email protected]>
> 
> Thanks,
> Thinh
> 
>> Signed-off-by: Pei Xiao <[email protected]>
>> ---
>>  drivers/usb/dwc3/gadget.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
>> index fa0f16ffafef..fa944856f956 100644
>> --- a/drivers/usb/dwc3/gadget.c
>> +++ b/drivers/usb/dwc3/gadget.c
>> @@ -3508,6 +3508,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
>>  		}
>>  
>>  		dwc3_debugfs_remove_endpoint_dir(dep);
>> +		cancel_delayed_work_sync(&dep->nostream_work);
>>  		kfree(dep);
>>  	}
>>  }
>> -- 
>> 2.25.1