WA2 internal requests use two independent list nodes. priv_req->list links a request into wa2_descmiss_req_list, while request.list links the same request into the pending or deferred request list. If an endpoint is disabled while an internal request is still deferred, cdns3_gadget_ep_disable() removes only priv_req->list before freeing the request. The following deferred-list cleanup then passes the freed request to cdns3_gadget_giveback(), where list_del_init() accesses freed memory. Initialize request.list when adding an internal request to the WA2 list, and remove it before freeing the request during endpoint disable. This also keeps the cleanup valid when queue setup fails before request.list is added to a request queue. A QEMU KASAN reproducer placed an internal request on both lists and invoked cdns3_gadget_ep_disable(). The unpatched kernel reported: BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report cdns3_gadget_giveback cdns3_gadget_ep_disable The fixed kernel completed endpoint cleanup without a KASAN or DEBUG_LIST report. The issue was found with a static analysis tool. Fixes: 6bbf87a131ed ("usb:cdns3 Fix for stuck packets in on-chip OUT buffer.") Cc: stable@vger.kernel.org Signed-off-by: Jaeyeong Lee --- drivers/usb/cdns3/cdns3-gadget.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index f4dfd01317083..70968e8f0d2da 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -605,9 +605,11 @@ static int cdns3_wa2_gadget_ep_queue(struct cdns3_device *priv_dev, deferred = 1; } - if (priv_req->flags & REQUEST_INTERNAL) + if (priv_req->flags & REQUEST_INTERNAL) { + INIT_LIST_HEAD(&priv_req->request.list); list_add_tail(&priv_req->list, &priv_ep->wa2_descmiss_req_list); + } } return deferred; @@ -2547,6 +2549,7 @@ static int cdns3_gadget_ep_disable(struct usb_ep *ep) while (!list_empty(&priv_ep->wa2_descmiss_req_list)) { priv_req = cdns3_next_priv_request(&priv_ep->wa2_descmiss_req_list); list_del_init(&priv_req->list); + list_del_init(&priv_req->request.list); kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, -- 2.43.0