In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
Considering that in some extreme cases, when performing the unbinding operation, gserialdisconnect has cleared gser->ioport, which triggers gadget reconfiguration, and then calls gsreadcomplete, resulting in access to a null pointer. Therefore, ep is disabled before gserialdisconnect sets port to null to prevent this from happening.
Call trace: gsreadcomplete+0x58/0x240 usbgadgetgivebackrequest+0x40/0x160 dwc3removerequests+0x170/0x484 dwc3ep0outstart+0xb0/0x1d4 _dwc3gadgetstart+0x25c/0x720 kretprobetrampoline.cfijt+0x0/0x8 kretprobetrampoline.cfijt+0x0/0x8 udcbindtodriver+0x1d8/0x300 usbgadgetprobedriver+0xa8/0x1dc gadgetdevdescUDCstore+0x13c/0x188 configfswriteiter+0x160/0x1f4 vfswrite+0x2d0/0x40c ksyswrite+0x7c/0xf0 _arm64syswrite+0x20/0x30 invokesyscall+0x60/0x150 el0svccommon+0x8c/0xf8 doel0svc+0x28/0xa0 el0svc+0x24/0x84