Re: [PATCH v2] usb: gadget: f_midi: fix UAF race during IN request handling

[sashiko-bot@kernel.org]

> f_midi_disable() drains and frees pre-allocated IN requests from
> in_req_fifo without holding midi->transmit_lock. If f_midi_transmit()
> runs concurrently on the workqueue, f_midi_do_transmit() can peek a
> request from in_req_fifo and write into its buffer while
> f_midi_disable() frees it, leading to a use-after-free.
> 
> Additionally, when usb_ep_queue() fails in f_midi_do_transmit() (such
> as with -ESHUTDOWN when the endpoint is disabled concurrently), it
> resets req->length = 0 and returns active instead of the error code,
> causing the do-while loop in f_midi_transmit() to keep spinning under
> midi->transmit_lock until the substream is drained.
> 
> Fix this by acquiring midi->transmit_lock in f_midi_disable() while
> releasing IN requests from in_req_fifo, and returning the error code
> from f_midi_do_transmit() when usb_ep_queue() fails so f_midi_transmit()
> aborts immediately and drops active substreams.
> 
> Fixes: e1e3d7ec5da3 ("usb: gadget: f_midi: pre-allocate IN requests")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028074821.579450-1-sonalipradhan@google.com?part=1