[PATCH] usb: gadget: f_midi: cancel work before midi is freed

[Adrian Korwel <adriank20047@gmail.com>]

f_midi_disable() disables the USB endpoints but does not cancel the
pending work item before returning. Since f_midi uses the system
high-priority workqueue (system_highpri_wq) rather than a dedicated
workqueue, there is no implicit draining when the function is unbound.

The work item f_midi_in_work can therefore be scheduled via
queue_work() from f_midi_complete() or f_midi_in_trigger() and execute
after f_midi_free() has run, resulting in a use-after-free when
f_midi_transmit() accesses midi->in_ep, midi->transmit_lock,
midi->in_req_fifo and midi->in_ports_array.

This was introduced in commit 8653d71ce376 ("usb/gadget: f_midi:
Replace tasklet with work") which converted from tasklet_hi_schedule()
to queue_work() but omitted the cancel_work_sync() call needed to
ensure the work is not in flight when the structure is freed. Tasklets
did not require explicit cancellation in this path; workqueues do.

Fix by calling cancel_work_sync() in f_midi_disable() after disabling
the endpoints, ensuring no work item referencing midi can run after
teardown begins.

Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Korwel <adriank20047@gmail.com>
---
 drivers/usb/gadget/function/f_midi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 4d9e4bd700d8..864527bf900c 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -430,6 +430,8 @@ static void f_midi_disable(struct usb_function *f)
 	usb_ep_disable(midi->in_ep);
 	usb_ep_disable(midi->out_ep);
 
+	cancel_work_sync(&midi->work);
+
 	/* release IN requests */
 	while (kfifo_get(&midi->in_req_fifo, &req))
 		free_ep_req(midi->in_ep, req);
-- 
2.43.0