Re: [PATCH] usb: gadget: raw_gadget: fix dangling ep->desc on enable failure

[Greg KH]

On Tue, Oct 27, 2026 at 11:23:23AM +0800, Liu Chao wrote:
> raw_ioctl_ep_enable() assigns the user-supplied endpoint descriptor
> to ep->ep->desc before calling usb_ep_enable(). If usb_ep_enable()
> fails, or if the subsequent usb_ep_alloc_request() fails, the error
> path frees desc via out_free but leaves ep->ep->desc pointing at the
> freed memory.
> 
> The UDC driver may have captured the stale descriptor pointer during
> the partial enable sequence and may dereference it in subsequent
> operations, resulting in a use-after-free.
> 
> Clear ep->ep->desc before jumping to out_free on both failure paths
> so the pointer never outlives the descriptor it references.
> 
> Fixes: 97df5e5758f7 ("usb: raw-gadget: fix gadget endpoint selection")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
> ---
>  drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
>  1 file changed, 2 insertions(+)

How was this found and tested?

thanks,

greg k-h