linux-kernel - [PATCH 0/6] usb: gadget: Refactor function drivers to use _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250916-ready-v1-0-4997bf277548@google.com>
Date: Tue, 16 Sep 2025 16:21:31 +0800
From: Kuen-Han Tsai <khtsai@...gle.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	David Brownell <dbrownell@...rs.sourceforge.net>, Nam Cao <namcao@...utronix.de>, 
	Zack Rusin <zack.rusin@...adcom.com>, 
	Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>, Prashanth K <prashanth.k@....qualcomm.com>, 
	Thinh Nguyen <Thinh.Nguyen@...opsys.com>, John Keeping <jkeeping@...usicbrands.com>, 
	Roy Luo <royluo@...gle.com>
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Kuen-Han Tsai <khtsai@...gle.com>, stable@...nel.org
Subject: [PATCH 0/6] usb: gadget: Refactor function drivers to use __free() cleanup

Hello,

This patch series refactors the error-handling paths in the bind()
function for f_ncm, f_acm, f_ecm, and f_rndis drivers. 

The current, unified goto logic in these drivers is vulnerable to a null
pointer dereference. This is caused by the cleanup logic incorrectly
handling the stale usb_request pointer after a bind/unbind cycle. This
series fixes this issue by converting the drivers to use the modern
__free() scope-based cleanup mechanism.

Patches 1-2 are preparatory, adding the endpoint pointer to struct
usb_request and defining helpers for the __free() cleanup. The remaining
four patches use this new plumbing to refactor each driver.

Future work
-----------

1. Refactor usb_ep_free_request(), usb_ep_queue(), and usb_ep_dequeue()
   functions as the ep parameter becomes redudant.
2. Convert the remaining gadget function drivers to use the new __free()
   cleanup mechanism.

Signed-off-by: Kuen-Han Tsai <khtsai@...gle.com>
---
Kuen-Han Tsai (6):
      usb: gadget: Store endpoint pointer in usb_request
      usb: gadget: Introduce free_usb_request helper
      usb: gadget: f_ncm: Refactor bind path to use __free()
      usb: gadget: f_acm: Refactor bind path to use __free()
      usb: gadget: f_ecm: Refactor bind path to use __free()
      usb: gadget: f_rndis: Refactor bind path to use __free()

 drivers/usb/gadget/function/f_acm.c   | 42 ++++++++---------
 drivers/usb/gadget/function/f_ecm.c   | 48 +++++++++-----------
 drivers/usb/gadget/function/f_ncm.c   | 78 ++++++++++++++------------------
 drivers/usb/gadget/function/f_rndis.c | 85 +++++++++++++++--------------------
 drivers/usb/gadget/udc/core.c         |  3 ++
 include/linux/usb/gadget.h            | 25 +++++++++++
 6 files changed, 135 insertions(+), 146 deletions(-)
---
base-commit: 1b237f190eb3d36f52dffe07a40b5eb210280e00
change-id: 20250916-ready-70b1c55d14b6

Best regards,
-- 
Kuen-Han Tsai <khtsai@...gle.com>