linux/drivers/usb/core
Hui Peng 0e8baa78d8 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In usb_enable_endpoint(), non-zero control endpoints (where
usb_endpoint_xfer_control(&ep->desc) is true) populate both
dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct
usb_host_endpoint pointer.

However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or
dev->ep_in[epnum] depending on the direction bit of epaddr when
reset_hardware is set, leaving the opposite direction's array slot
pointing to the disabled/freed endpoint.

Clear both dev->ep_out[epnum] and dev->ep_in[epnum] when disabling a
non-ep0 control endpoint with reset_hardware set, and update the
function kerneldoc accordingly.

Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd and raw-gadget to
enumerate a USB device with a non-zero control endpoint
(bEndpointAddress 0x01, bmAttributes USB_ENDPOINT_XFER_CONTROL),
verifying that both dev->ep_in[1] and dev->ep_out[1] are cleared when
the interface is disabled.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable <stable@kernel.org>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260920231702.110963-1-benquike@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-01 07:12:23 +02:00
..
buffer.c
config.c Merge 7.2-rc7 into usb-next 2026-08-14 10:17:11 +09:00
devices.c usb: core: devices: use kmalloc() to allocate dump buffer 2026-07-08 14:10:53 +02:00
devio.c usb: usbfs: fix use-after-free of usb_device in usbdev_release() 2026-08-14 10:49:38 +09:00
driver.c usb: fix UAF when probe runs concurrent to dyn ID removal 2026-07-10 15:16:07 +02:00
endpoint.c usb: endpoint: drop custom sysfs attribute structure 2026-03-11 15:48:20 +01:00
file.c
generic.c USB: lower "Device is not authorized for usage" message to info 2025-08-13 16:55:27 +02:00
hcd-pci.c usb: core: modify comments xhci_hc_driver has HCD_MEMORY just like ehci ohci 2025-06-19 12:31:16 +02:00
hcd.c Linux 7.1-rc6 2026-06-01 17:39:51 +02:00
hub.c usb: hub: use shorter 120ms post resume hold for SS root hubs 2026-09-10 17:07:20 +02:00
hub.h usb: hub: Fix flushing of delayed work used for post resume purposes 2025-06-30 15:36:00 +02:00
Kconfig
ledtrig-usbport.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Makefile usb: core: Add tracepoints for device allocation and state changes 2025-10-22 10:58:30 +02:00
message.c usb: core: clear both ep_in and ep_out for non-ep0 control endpoints 2026-10-01 07:12:23 +02:00
notify.c
of.c USB: of: Simplify with scoped for each OF child loop 2026-04-07 13:49:48 +02:00
offload.c usb: core: use dedicated spinlock for offload state 2026-04-02 09:43:26 +02:00
otg_productlist.h
phy.c usb: core: phy: avoid double use of 'usb3-phy' 2026-04-02 09:19:31 +02:00
phy.h
port.c usb: core: port: Deattach Type-C connector on component unbind 2026-07-16 17:11:22 +02:00
quirks.c usb: quirks: Add ShanWan gamepad to quirk list 2026-08-03 17:25:44 +02:00
sysfs.c usb: core: sysfs: add lock to bos_descriptors_read() 2026-07-16 17:11:44 +02:00
trace.c usb: core: Add tracepoints for device allocation and state changes 2025-10-22 10:58:30 +02:00
trace.h usb: core: Add tracepoints for device allocation and state changes 2025-10-22 10:58:30 +02:00
urb.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
usb-acpi.c usb: acpi: fix device link removal 2025-06-19 12:36:19 +02:00
usb.c usb: core: use dedicated spinlock for offload state 2026-04-02 09:43:26 +02:00
usb.h USB: make to_usb_device_driver() use container_of_const() 2024-11-14 17:57:33 +01:00