[PATCH RFC] usb: gadget: midi2: Fix memory leak in configfs default groups

["syzbot" <syzbot@kernel.org>]

When a USB function instance for midi2 is allocated, it dynamically
allocates ep_opts and block_opts structures and adds them as default groups
(ep.0 and block.0). While configfs removes the dentries for default groups
when the parent directory is removed, it does not automatically drop their
reference counts. This responsibility lies with the driver.

Because f_midi2_free_inst() and f_midi2_ep_opts_release() do not clean up
their default groups, the ep_opts and block_opts structures are leaked when
the function instance is destroyed.

Fix this by explicitly calling configfs_remove_default_groups() in the
respective release functions. This ensures that the reference counts of the
default groups are properly dropped, triggering the existing release
callbacks (f_midi2_ep_opts_release and f_midi2_block_opts_release) to
safely free the dynamically allocated memory.

Kmemleak reports:

BUG: memory leak
unreferenced object 0xffff88810aacb200 (size 512):
  comm "syz.0.19", pid 6225, jiffies 4294944049
  hex dump (first 32 bytes):
    08 b2 ac 0a 81 88 ff ff 65 70 2e 30 00 00 00 00  ........ep.0....
    00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00  ................
  backtrace (crc f2efe6a4):
    ...
    f_midi2_ep_opts_create drivers/usb/gadget/function/f_midi2.c:2504
    [inline]
    f_midi2_alloc_inst+0x80/0x2c0
    drivers/usb/gadget/function/f_midi2.c:2666
    ...

BUG: memory leak
unreferenced object 0xffff8881083d9e00 (size 256):
  comm "syz.0.19", pid 6225, jiffies 4294944049
  hex dump (first 32 bytes):
    08 9e 3d 08 81 88 ff ff 62 6c 6f 63 6b 2e 30 00  ..=.....block.0.
    00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00  ................
  backtrace (crc cc37bc9e):
    ...
    f_midi2_block_opts_create drivers/usb/gadget/function/f_midi2.c:2342
    [inline]
    f_midi2_alloc_inst+0x16a/0x2c0
    drivers/usb/gadget/function/f_midi2.c:2673
    ...

Fixes: 29ee7a4dddd5 ("usb: gadget: midi2: Add configfs support")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95
Link: https://syzkaller.appspot.com/ai_job?id=9087164f-64c8-456d-abd0-052d4a7f1ddd
To: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
To: <linux-usb@vger.kernel.org>
To: "Takashi Iwai" <tiwai@suse.de>
Cc: "Christophe JAILLET" <christophe.jaillet@wanadoo.fr>
Cc: "Kees Cook" <kees@kernel.org>
Cc: <linux-kernel@vger.kernel.org>

---
diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
index 19fdac024..ec4266ecc 100644
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -2473,6 +2473,7 @@ static void f_midi2_ep_opts_release(struct config_item *item)
 {
 	struct f_midi2_ep_opts *opts = to_f_midi2_ep_opts(item);
 
+	configfs_remove_default_groups(to_config_group(item));
 	kfree(opts->info.ep_name);
 	kfree(opts->info.product_id);
 	kfree(opts);
@@ -2639,6 +2640,7 @@ static void f_midi2_free_inst(struct usb_function_instance *f)
 
 	opts = container_of(f, struct f_midi2_opts, func_inst);
 
+	configfs_remove_default_groups(&opts->func_inst.group);
 	kfree(opts->info.iface_name);
 	kfree(opts);
 }


base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.