Re: [PATCH v2] usb: gadget: lpc32xx_udc: drain the pullup work on removal

[sashiko-bot@kernel.org]

> isp1301_pullup_enable() schedules udc->pullup_job to perform the slow
> isp1301 i2c pull-up access from process context. The work handler
> (pullup_work) dereferences udc and touches the isp1301 i2c client.
> 
> udc is allocated with devm_kmemdup(), so devres frees it after
> lpc32xx_udc_remove() returns. remove() calls pullup(udc, 0) -- which
> queues pullup_job to clear the D+ pull-up -- but never drains it, so the
> work can run after udc has been freed (and the isp1301 client put),
> dereferencing freed memory -- a use-after-free.
> 
> Flush pullup_job in lpc32xx_udc_remove() after the final pullup(udc, 0).
> flush_work() (rather than cancel_work_sync()) lets the queued pull-up
> disable actually complete before the udc and its isp1301 client are
> released, so the transceiver is left with D+ deasserted.
> 
> Found by static analysis; not runtime-reproduced (needs LPC32xx USB
> gadget hardware with the isp1301 transceiver).
> 
> Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110120243.2540098-1-hj351016@gmail.com?part=1