[PATCH v2] usb: gadget: f_midi: fix UAF race during IN request handling

[PATCH v2] usb: gadget: f_midi: fix UAF race during IN request handling

[Sonali Pradhan]

f_midi_disable() drains and frees pre-allocated IN requests from
in_req_fifo without holding midi->transmit_lock. If f_midi_transmit()
runs concurrently on the workqueue, f_midi_do_transmit() can peek a
request from in_req_fifo and write into its buffer while
f_midi_disable() frees it, leading to a use-after-free.

Additionally, when usb_ep_queue() fails in f_midi_do_transmit() (such
as with -ESHUTDOWN when the endpoint is disabled concurrently), it
resets req->length = 0 and returns active instead of the error code,
causing the do-while loop in f_midi_transmit() to keep spinning under
midi->transmit_lock until the substream is drained.

Fix this by acquiring midi->transmit_lock in f_midi_disable() while
releasing IN requests from in_req_fifo, and returning the error code
from f_midi_do_transmit() when usb_ep_queue() fails so f_midi_transmit()
aborts immediately and drops active substreams.

Fixes: e1e3d7ec5da3 ("usb: gadget: f_midi: pre-allocate IN requests")
Cc: stable@vger.kernel.org
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
---
Changes in v2:
- Remove the transmit_lock and ep->enabled checks added in v1 from
  f_midi_complete() and f_midi_transmit().
- Return error code from f_midi_do_transmit() when usb_ep_queue() fails
  so f_midi_transmit() aborts the loop immediately.
- Link to v1: https://lore.kernel.org/all/20261019135701.2767078-1-sonalipradhan@google.com/

 drivers/usb/gadget/function/f_midi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 63fb6ee70a3d..48cda34399e8 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -420,6 +420,7 @@ static void f_midi_disable(struct usb_function *f)
 	struct f_midi *midi = func_to_midi(f);
 	struct usb_composite_dev *cdev = f->config->cdev;
 	struct usb_request *req = NULL;
+	unsigned long flags;
 
 	DBG(cdev, "disable\n");
 
@@ -431,8 +432,10 @@ static void f_midi_disable(struct usb_function *f)
 	usb_ep_disable(midi->out_ep);
 
 	/* release IN requests */
+	spin_lock_irqsave(&midi->transmit_lock, flags);
 	while (kfifo_get(&midi->in_req_fifo, &req))
 		free_ep_req(midi->in_ep, req);
+	spin_unlock_irqrestore(&midi->transmit_lock, flags);
 
 	f_midi_drop_out_substreams(midi);
 }
@@ -661,6 +664,7 @@ static int f_midi_do_transmit(struct f_midi *midi, struct usb_ep *ep)
 		ERROR(midi, "%s failed to queue req: %d\n",
 		      midi->in_ep->name, err);
 		req->length = 0; /* Re-use request next time. */
+		return err;
 	} else {
 		/* Upon success, put request at the back of the queue. */
 		kfifo_skip(&midi->in_req_fifo);
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH v2] usb: gadget: f_midi: fix UAF race during IN request handling

[sashiko-bot]

> f_midi_disable() drains and frees pre-allocated IN requests from
> in_req_fifo without holding midi->transmit_lock. If f_midi_transmit()
> runs concurrently on the workqueue, f_midi_do_transmit() can peek a
> request from in_req_fifo and write into its buffer while
> f_midi_disable() frees it, leading to a use-after-free.
> 
> Additionally, when usb_ep_queue() fails in f_midi_do_transmit() (such
> as with -ESHUTDOWN when the endpoint is disabled concurrently), it
> resets req->length = 0 and returns active instead of the error code,
> causing the do-while loop in f_midi_transmit() to keep spinning under
> midi->transmit_lock until the substream is drained.
> 
> Fix this by acquiring midi->transmit_lock in f_midi_disable() while
> releasing IN requests from in_req_fifo, and returning the error code
> from f_midi_do_transmit() when usb_ep_queue() fails so f_midi_transmit()
> aborts immediately and drops active substreams.
> 
> Fixes: e1e3d7ec5da3 ("usb: gadget: f_midi: pre-allocate IN requests")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028074821.579450-1-sonalipradhan@google.com?part=1