[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Adrian Korwel]

From: Adrian Korwel <adriank20047@gmail.com>

f_midi_disable() disables the USB endpoints but does not cancel the
pending work item before returning. Since f_midi uses the system
high-priority workqueue (system_highpri_wq) rather than a dedicated
workqueue, there is no implicit draining when the function is unbound.

The work item f_midi_in_work can therefore be scheduled via
queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
after f_midi_free() has run, resulting in a use-after-free when
f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
midi->in_req_fifo and midi->in_ports_array.

This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
Replace tasklet with work") which converted from tasklet_hi_schedule()
to queue_work() but omitted the cancel_work_sync() call needed to
ensure the work is not in flight when the structure is freed. Tasklets
did not require explicit cancellation in this path; workqueues do.

Fix by calling cancel_work_sync() in f_midi_disable() after disabling
the endpoints, ensuring no work item referencing midi can run after
teardown begins.

Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
---
 drivers/usb/gadget/function/f_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c
b/drivers/usb/gadget/function/f_midi.c
index 4d9e4bd700d8..864527bf900c 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
        usb_ep_disable(midi->in_ep);
        usb_ep_disable(midi->out_ep);

+       cancel_work_sync(&midi->work);
+
        /* release IN requests */
        while (kfifo_get(&midi->in_req_fifo, &req))
                free_ep_req(midi->in_ep, req);
-- 
2.43.0

Re: [PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Greg KH]

On Sun, May 24, 2026 at 08:40:25PM -0500, Adrian Korwel wrote:
> From: Adrian Korwel <adriank20047@gmail.com>
> 
> f_midi_disable() disables the USB endpoints but does not cancel the
> pending work item before returning. Since f_midi uses the system
> high-priority workqueue (system_highpri_wq) rather than a dedicated
> workqueue, there is no implicit draining when the function is unbound.
> 
> The work item f_midi_in_work can therefore be scheduled via
> queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
> after f_midi_free() has run, resulting in a use-after-free when
> f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
> midi->in_req_fifo and midi->in_ports_array.
> 
> This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
> Replace tasklet with work") which converted from tasklet_hi_schedule()
> to queue_work() but omitted the cancel_work_sync() call needed to
> ensure the work is not in flight when the structure is freed. Tasklets
> did not require explicit cancellation in this path; workqueues do.
> 
> Fix by calling cancel_work_sync() in f_midi_disable() after disabling
> the endpoints, ensuring no work item referencing midi can run after
> teardown begins.
> 
> Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
> ---
>  drivers/usb/gadget/function/f_midi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/gadget/function/f_midi.c
> b/drivers/usb/gadget/function/f_midi.c
> index 4d9e4bd700d8..864527bf900c 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
>         usb_ep_disable(midi->in_ep);
>         usb_ep_disable(midi->out_ep);
> 
> +       cancel_work_sync(&midi->work);
> +
>         /* release IN requests */
>         while (kfifo_get(&midi->in_req_fifo, &req))
>                 free_ep_req(midi->in_ep, req);
> -- 
> 2.43.0

This is corrupted, please don't use web email clients :(

[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Adrian Korwel]

f_midi_disable() disables the USB endpoints but does not cancel the
pending work item before returning. Since f_midi uses the system
high-priority workqueue (system_highpri_wq) rather than a dedicated
workqueue, there is no implicit draining when the function is unbound.

The work item f_midi_in_work can therefore be scheduled via
queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
after f_midi_free() has run, resulting in a use-after-free when
f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
midi->in_req_fifo and midi->in_ports_array.

This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
Replace tasklet with work") which converted from tasklet_hi_schedule()
to queue_work() but omitted the cancel_work_sync() call needed to
ensure the work is not in flight when the structure is freed. Tasklets
did not require explicit cancellation in this path; workqueues do.

Fix by calling cancel_work_sync() in f_midi_disable() after disabling
the endpoints, ensuring no work item referencing midi can run after
teardown begins.

Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
---
 drivers/usb/gadget/function/f_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 4d9e4bd700d8..864527bf900c 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
 	usb_ep_disable(midi->in_ep);
 	usb_ep_disable(midi->out_ep);
 
+	cancel_work_sync(&midi->work);
+
 	/* release IN requests */
 	while (kfifo_get(&midi->in_req_fifo, &req))
 		free_ep_req(midi->in_ep, req);
-- 
2.43.0