Re: [PATCH v4 0/2] usb: gadget: gadgetfs: fix ep0 request lifetime and event counter

[Alan Stern]

On Sat, Nov 07, 2026 at 09:46:12PM +0900, Jing Lin via B4 Relay wrote:
> gadgetfs_unbind() frees the preallocated ep0 request after disconnecting
> the gadget, assuming that no I/O remains active. With dummy_hcd, a
> delayed userspace response can leave the request queued when it is freed,
> which triggers the warning in dummy_free_request() and a use-after-free
> when dummy_udc_stop() drains the endpoint queue.

That's right; gadget drivers in general are responsible for cancelling 
any outstanding ep0 requests when they unbind, and not submitting any 
new ones.

Another thing worth fixing is near the start of gadgetfs_setup(), 
where it casts away the constness of ctrl.  This may not cause problems 
in practice, but it definitely has a bad look.

> gadgetfs_setup() and ep0_write() also race on dev->req and req->buf
> while a control transfer is in flight or while a completed delegated OUT
> transfer is waiting for ep0_read() to copy the payload to userspace.

Can you explain these races in greater detail, showing how they occur?

> Overwriting req->buf with a descriptor pointer causes clean_req() to
> free the descriptor buffer instead of the request buffer.

Can some of these problems be solved more simply, by using a new mutex 
to protect dev->req and related values?

Alan Stern