[PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Liu Chao]

raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
fails, or if the subsequent usb_ep_alloc_request() fails, the error
path frees desc via out_free but leaves ep->ep->desc pointing at the
freed memory.

The UDC driver may have captured the stale descriptor pointer during
the partial enable sequence and may dereference it in subsequent
operations, resulting in a use-after-free.

Clear ep->ep->desc before jumping to out_free on both failure paths
so the pointer never outlives the descriptor it references.

Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
---
 drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index 46f343ba4..b52ab3ce7 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -886,6 +886,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 		if (ret < 0) {
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_enable returned %d\n", ret);
+			ep->ep->desc = NULL;
 			goto out_free;
 		}
 		ep->req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
@@ -893,6 +894,7 @@ static int raw_ioctl_ep_enable(struct raw_dev *dev, unsigned long value)
 			dev_err(&dev->gadget->dev,
 				"fail, usb_ep_alloc_request failed\n");
 			usb_ep_disable(ep->ep);
+			ep->ep->desc = NULL;
 			ret = -ENOMEM;
 			goto out_free;
 		}
--
2.50.1