Re: [PATCH] usb: gadget: midi2: copy configfs strings for live functions

[sashiko-bot@kernel.org]

> f_midi2_alloc() shallow-copies the card, endpoint, and block string
> pointers from configfs.  Dynamic ep.* and block.* groups may be removed
> after the function has been allocated.  Their release callbacks then free
> strings still used by live USB string descriptors and UMP discovery
> replies.
> 
> Copy the optional strings while opts->lock is held, so configfs release
> cannot free the source strings during the copy.  Free the private copies
> with the live function and build the USB string table from those copies.
> 
> Fixes: 29ee7a4dddd5 ("usb: gadget: midi2: Add configfs support")
> 
> Tested:
>   x86_64 KASAN dummy_hcd: the base kernel reports two slab-use-after-free
>   errors after removing a dynamic block and endpoint; the fixed kernel
>   completes the same descriptor requests without a KASAN report.
>   x86_64 and arm64 MIDI2 function object builds with W=1.
> Signed-off-by: Yingjie Wang <x-professor@outlook.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/e638dc9ab93c4b90c263d7ec836735eb17335cda.1793980732.git.x-professor@outlook.com?part=1