From: sashiko-bot@kernel.org
To: "Yingjie Wang" <x-professor@outlook.com>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>
Subject: Re: [PATCH] usb: gadget: midi2: copy configfs strings for live functions
Date: Fri, 06 Nov 2026 16:09:39 +0000 [thread overview]
Message-ID: <sashiko-outbox-201772@kernel.org> (raw)
In-Reply-To: <e638dc9ab93c4b90c263d7ec836735eb17335cda.1793980732.git.x-professor@outlook.com>
> f_midi2_alloc() shallow-copies the card, endpoint, and block string
> pointers from configfs. Dynamic ep.* and block.* groups may be removed
> after the function has been allocated. Their release callbacks then free
> strings still used by live USB string descriptors and UMP discovery
> replies.
>
> Copy the optional strings while opts->lock is held, so configfs release
> cannot free the source strings during the copy. Free the private copies
> with the live function and build the USB string table from those copies.
>
> Fixes: 29ee7a4dddd5 ("usb: gadget: midi2: Add configfs support")
>
> Tested:
> x86_64 KASAN dummy_hcd: the base kernel reports two slab-use-after-free
> errors after removing a dynamic block and endpoint; the fixed kernel
> completes the same descriptor requests without a KASAN report.
> x86_64 and arm64 MIDI2 function object builds with W=1.
> Signed-off-by: Yingjie Wang <x-professor@outlook.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/e638dc9ab93c4b90c263d7ec836735eb17335cda.1793980732.git.x-professor@outlook.com?part=1
prev parent reply other threads:[~2026-11-06 16:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 15:59 [PATCH] usb: gadget: midi2: copy configfs strings for live functions Yingjie Wang
2026-11-06 16:09 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-201772@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=x-professor@outlook.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.