usbip: vudc: get vudc from endpoint in vep_dequeue

vep_dequeue() looks up the virtual UDC through vrequest->udc, but that field is never initialized when requests are allocated or queued. A gadget function that dequeues a request during disconnect can therefore dereference a NULL vudc pointer and crash the kernel.

This was observed with a USB/IP vUDC ACM gadget. ACM is not unique here; it was only the tested gadget path. The bug is in the generic vUDC dequeue path rather than in ACM itself.

Use the endpoint to recover the vudc, as the other vUDC endpoint ops already do, instead of relying on the request-private field.

---
 drivers/usb/usbip/vudc_dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index c5f079c5a1ea..f0a1a44c18e3 100644
@@ -344,7 +344,7 @@ static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
 	ep = to_vep(_ep);
 	req = to_vrequest(_req);
-	udc = req->udc;
+	udc = ep_to_vudc(ep);
 
 	if (!udc->driver)
 		return -ESHUTDOWN;

base-commit: 186d3c4e92242351afc24d9784f31cb4cd08a4b7

2.53.0.windows.1

When you author and sign off on a patch, you don't need the reported-by line.

Anyway, isn't this patch:

	https://lore.kernel.org/r/[email protected]

a better one instead?

thanks,

greg k-h