Re: [PATCH RESEND] usb: gadget: f_midi: fix UAF race during IN request handling

[Sonali Pradhan]

On Tue, 20 Oct 2026 11:06:57 +0200,
Takashi Iwai wrote:
>
> On Mon, 19 Oct 2026 15:57:01 +0200,
> Sonali Pradhan wrote:
> >
> > diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
> > index 63fb6ee70a3d..c26d04eb9209 100644
> > --- a/drivers/usb/gadget/function/f_midi.c
> > +++ b/drivers/usb/gadget/function/f_midi.c
> > @@ -280,9 +280,18 @@ f_midi_complete(struct usb_ep *ep, struct usb_request *req)
> >                     /* We received stuff. req is queued again, below */
> >                     f_midi_handle_out_data(ep, req);
> >             } else if (ep == midi->in_ep) {
> > +                   unsigned long flags;
> > +
> >                     /* Our transmit completed. See if there's more to go.
> >                      * f_midi_transmit eats req, don't queue it again. */
> > +                   spin_lock_irqsave(&midi->transmit_lock, flags);
> > +                   if (!ep->enabled) {
> > +                           spin_unlock_irqrestore(&midi->transmit_lock, flags);
> > +                           return;
> > +                   }
> >                     req->length = 0;
> > +                   spin_unlock_irqrestore(&midi->transmit_lock, flags);
> > +
>
> Does this transmit_lock help here?  As far as I see, the ep
> enable/disable itself is done outside the lock.
>
> > @@ -678,10 +690,11 @@ static void f_midi_transmit(struct f_midi *midi)
> >     unsigned long flags;
> >
> >     /* We only care about USB requests if IN endpoint is enabled */
> > -   if (!ep || !ep->enabled)
> > -           goto drop_out;
> > -
> >     spin_lock_irqsave(&midi->transmit_lock, flags);
> > +   if (!ep || !ep->enabled) {
> > +           spin_unlock_irqrestore(&midi->transmit_lock, flags);
> > +           goto drop_out;
> > +   }
>
> Ditto.

You are right about this. I'll rework the patch along with the issues
noted in Sashiko's review and send a v2.

Thanks,
Sonali