[PATCH] usb: gadget: midi2: remove default configfs groups on teardown

[PATCH] usb: gadget: midi2: remove default configfs groups on teardown

[Joshua Crofts]

f_midi2_alloc_inst() creates default configfs child groups for the
default endpoint and default block using configfs_add_default_group(),
setting their internal refcount to 1.

However, during function teardown in f_midi2_free_inst() or EP cleanup
in f_midi2_ep_opts_release(), configfs_remove_default_groups() is
never called, therefore never dropping the refcount and leaking struct
f_midi2_ep_opts and f_midi2_block_opts.

Add the missing configfs_remove_default_groups() in the afformentioned
functions to free the structs properly.

Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
Cc: <stable@vger.kernel.org>
Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
Aside from testing the fix locally with QEMU and the reproducer,
syzbot also reports no issues after running `syz test`.
---
 drivers/usb/gadget/function/f_midi2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
index 19fdac024..a4b72a6fa 100644
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -2473,6 +2473,7 @@ static void f_midi2_ep_opts_release(struct config_item *item)
 {
 	struct f_midi2_ep_opts *opts = to_f_midi2_ep_opts(item);
 
+	configfs_remove_default_groups(&opts->group);
 	kfree(opts->info.ep_name);
 	kfree(opts->info.product_id);
 	kfree(opts);
@@ -2639,6 +2640,7 @@ static void f_midi2_free_inst(struct usb_function_instance *f)
 
 	opts = container_of(f, struct f_midi2_opts, func_inst);
 
+	configfs_remove_default_groups(&opts->func_inst.group);
 	kfree(opts->info.iface_name);
 	kfree(opts);
 }
-- 
2.47.3

Re: [PATCH] usb: gadget: midi2: remove default configfs groups on teardown

[Joshua Crofts]

On Thu, 30 Jul 2026 at 15:58, Joshua Crofts <joshua.crofts1@gmail.com> wrote:
>
> f_midi2_alloc_inst() creates default configfs child groups for the
> default endpoint and default block using configfs_add_default_group(),
> setting their internal refcount to 1.
>
> However, during function teardown in f_midi2_free_inst() or EP cleanup
> in f_midi2_ep_opts_release(), configfs_remove_default_groups() is
> never called, therefore never dropping the refcount and leaking struct
> f_midi2_ep_opts and f_midi2_block_opts.
>
> Add the missing configfs_remove_default_groups() in the afformentioned
> functions to free the structs properly.
>
> Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
> Cc: <stable@vger.kernel.org>
> Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
> Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
> Aside from testing the fix locally with QEMU and the reproducer,
> syzbot also reports no issues after running `syz test`.
> ---

Hi Greg,

Gentle ping on this patch.

Kind regards,
Joshua Crofts

Re: [PATCH] usb: gadget: midi2: remove default configfs groups on teardown

[Greg Kroah-Hartman]

On Mon, Aug 03, 2026 at 07:59:17AM +0200, Joshua Crofts wrote:
> On Thu, 30 Jul 2026 at 15:58, Joshua Crofts <joshua.crofts1@gmail.com> wrote:
> >
> > f_midi2_alloc_inst() creates default configfs child groups for the
> > default endpoint and default block using configfs_add_default_group(),
> > setting their internal refcount to 1.
> >
> > However, during function teardown in f_midi2_free_inst() or EP cleanup
> > in f_midi2_ep_opts_release(), configfs_remove_default_groups() is
> > never called, therefore never dropping the refcount and leaking struct
> > f_midi2_ep_opts and f_midi2_block_opts.
> >
> > Add the missing configfs_remove_default_groups() in the afformentioned
> > functions to free the structs properly.
> >
> > Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
> > Cc: <stable@vger.kernel.org>
> > Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
> > Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> > ---
> > Aside from testing the fix locally with QEMU and the reproducer,
> > syzbot also reports no issues after running `syz test`.
> > ---
> 
> Hi Greg,
> 
> Gentle ping on this patch.

It's been 2 "business days" since you sent this.  What's the rush?  If
you wish to see patches reviewed faster, please help out in reviewing
other patches on the list.

And as this is really only a syzbot issue, the "severity" is low, right?

thanks,

greg k-h

Re: [PATCH] usb: gadget: midi2: remove default configfs groups on teardown

[Joshua Crofts]

On Mon, 3 Aug 2026 08:25:35 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> On Mon, Aug 03, 2026 at 07:59:17AM +0200, Joshua Crofts wrote:
> > On Thu, 30 Jul 2026 at 15:58, Joshua Crofts <joshua.crofts1@gmail.com> wrote:  
> > >
> > > f_midi2_alloc_inst() creates default configfs child groups for the
> > > default endpoint and default block using configfs_add_default_group(),
> > > setting their internal refcount to 1.
> > >
> > > However, during function teardown in f_midi2_free_inst() or EP cleanup
> > > in f_midi2_ep_opts_release(), configfs_remove_default_groups() is
> > > never called, therefore never dropping the refcount and leaking struct
> > > f_midi2_ep_opts and f_midi2_block_opts.
> > >
> > > Add the missing configfs_remove_default_groups() in the afformentioned
> > > functions to free the structs properly.
> > >
> > > Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver")
> > > Cc: <stable@vger.kernel.org>
> > > Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
> > > Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
> > > Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> > > ---
> > > Aside from testing the fix locally with QEMU and the reproducer,
> > > syzbot also reports no issues after running `syz test`.
> > > ---  
> > 
> > Hi Greg,
> > 
> > Gentle ping on this patch.  
> 
> It's been 2 "business days" since you sent this.  What's the rush?  If
> you wish to see patches reviewed faster, please help out in reviewing
> other patches on the list.
> 
> And as this is really only a syzbot issue, the "severity" is low, right?
> 
> thanks,
> 
> greg k-h

Apologies, I let my impatience get the better of me :( won't happen again.

-- 
Kind regards,
Joshua Crofts