[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Adrian Korwel]

From: Adrian Korwel <adriank20047@gmail.com>

f_midi_disable() disables the USB endpoints but does not cancel the
pending work item before returning. Since f_midi uses the system
high-priority workqueue (system_highpri_wq) rather than a dedicated
workqueue, there is no implicit draining when the function is unbound.

The work item f_midi_in_work can therefore be scheduled via
queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
after f_midi_free() has run, resulting in a use-after-free when
f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
midi->in_req_fifo and midi->in_ports_array.

This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
Replace tasklet with work") which converted from tasklet_hi_schedule()
to queue_work() but omitted the cancel_work_sync() call needed to
ensure the work is not in flight when the structure is freed. Tasklets
did not require explicit cancellation in this path; workqueues do.

Fix by calling cancel_work_sync() in f_midi_disable() after disabling
the endpoints, ensuring no work item referencing midi can run after
teardown begins.

Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
---
 drivers/usb/gadget/function/f_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c
b/drivers/usb/gadget/function/f_midi.c
index 4d9e4bd700d8..864527bf900c 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
        usb_ep_disable(midi->in_ep);
        usb_ep_disable(midi->out_ep);

+       cancel_work_sync(&midi->work);
+
        /* release IN requests */
        while (kfifo_get(&midi->in_req_fifo, &req))
                free_ep_req(midi->in_ep, req);
-- 
2.43.0

Re: [PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Greg KH]

On Sun, May 24, 2026 at 08:40:25PM -0500, Adrian Korwel wrote:
> From: Adrian Korwel <adriank20047@gmail.com>
> 
> f_midi_disable() disables the USB endpoints but does not cancel the
> pending work item before returning. Since f_midi uses the system
> high-priority workqueue (system_highpri_wq) rather than a dedicated
> workqueue, there is no implicit draining when the function is unbound.
> 
> The work item f_midi_in_work can therefore be scheduled via
> queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
> after f_midi_free() has run, resulting in a use-after-free when
> f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
> midi->in_req_fifo and midi->in_ports_array.
> 
> This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
> Replace tasklet with work") which converted from tasklet_hi_schedule()
> to queue_work() but omitted the cancel_work_sync() call needed to
> ensure the work is not in flight when the structure is freed. Tasklets
> did not require explicit cancellation in this path; workqueues do.
> 
> Fix by calling cancel_work_sync() in f_midi_disable() after disabling
> the endpoints, ensuring no work item referencing midi can run after
> teardown begins.
> 
> Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
> ---
>  drivers/usb/gadget/function/f_midi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/gadget/function/f_midi.c
> b/drivers/usb/gadget/function/f_midi.c
> index 4d9e4bd700d8..864527bf900c 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
>         usb_ep_disable(midi->in_ep);
>         usb_ep_disable(midi->out_ep);
> 
> +       cancel_work_sync(&midi->work);
> +
>         /* release IN requests */
>         while (kfifo_get(&midi->in_req_fifo, &req))
>                 free_ep_req(midi->in_ep, req);
> -- 
> 2.43.0

This is corrupted, please don't use web email clients :(

[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Adrian Korwel]

f_midi_disable() disables the USB endpoints but does not cancel the
pending work item before returning. Since f_midi uses the system
high-priority workqueue (system_highpri_wq) rather than a dedicated
workqueue, there is no implicit draining when the function is unbound.

The work item f_midi_in_work can therefore be scheduled via
queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
after f_midi_free() has run, resulting in a use-after-free when
f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
midi->in_req_fifo and midi->in_ports_array.

This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
Replace tasklet with work") which converted from tasklet_hi_schedule()
to queue_work() but omitted the cancel_work_sync() call needed to
ensure the work is not in flight when the structure is freed. Tasklets
did not require explicit cancellation in this path; workqueues do.

Fix by calling cancel_work_sync() in f_midi_disable() after disabling
the endpoints, ensuring no work item referencing midi can run after
teardown begins.

Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
---
 drivers/usb/gadget/function/f_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 4d9e4bd700d8..864527bf900c 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
 	usb_ep_disable(midi->in_ep);
 	usb_ep_disable(midi->out_ep);
 
+	cancel_work_sync(&midi->work);
+
 	/* release IN requests */
 	while (kfifo_get(&midi->in_req_fifo, &req))
 		free_ep_req(midi->in_ep, req);
-- 
2.43.0

Re: [PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Greg KH]

On Mon, May 25, 2026 at 10:01:39AM -0500, Adrian Korwel wrote:
> f_midi_disable() disables the USB endpoints but does not cancel the
> pending work item before returning. Since f_midi uses the system
> high-priority workqueue (system_highpri_wq) rather than a dedicated
> workqueue, there is no implicit draining when the function is unbound.
> 
> The work item f_midi_in_work can therefore be scheduled via
> queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
> after f_midi_free() has run, resulting in a use-after-free when
> f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
> midi->in_req_fifo and midi->in_ports_array.
> 
> This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
> Replace tasklet with work") which converted from tasklet_hi_schedule()
> to queue_work() but omitted the cancel_work_sync() call needed to
> ensure the work is not in flight when the structure is freed. Tasklets
> did not require explicit cancellation in this path; workqueues do.
> 
> Fix by calling cancel_work_sync() in f_midi_disable() after disabling
> the endpoints, ensuring no work item referencing midi can run after
> teardown begins.
> 
> Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
> ---
>  drivers/usb/gadget/function/f_midi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
> index 4d9e4bd700d8..864527bf900c 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
>  	usb_ep_disable(midi->in_ep);
>  	usb_ep_disable(midi->out_ep);
>  
> +	cancel_work_sync(&midi->work);
> +
>  	/* release IN requests */
>  	while (kfifo_get(&midi->in_req_fifo, &req))
>  		free_ep_req(midi->in_ep, req);
> -- 
> 2.43.0
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:


- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot