Re: [PATCH] usb: gadget: f_midi2: fix use-after-free in string attribute show path

[Takashi Iwai]

On Sun, 16 Aug 2026 02:54:33 +0200,
Ivy Lopez wrote:
> 
> f_midi2_opts_str_show() takes the string lock internally, but its
> callers dereference the opts->info.<field> pointer before calling it,
> outside the lock. This races with f_midi2_opts_str_store(), which
> frees the old string under opts->lock when the attribute is written
> concurrently, the show path can read a pointer that gets freed
> before the lock inside str_show() is even taken.
> 
> Change f_midi2_opts_str_show() to take a pointer to the string field,
> matching the existing pattern in f_midi2_opts_str_store(), and
> dereference it only after the lock is held. Update all three callers
> (iface_name, block name, and the EP string option macro) accordingly.
> 
> Reported-by: syzbot+2280f1cca5e6b0c353e4@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=2280f1cca5e6b0c353e4
> Signed-off-by: Ivy Lopez <skunkolee@xxxxxxxxx>

Reviewed-by: Takashi Iwai <tiwai@xxxxxxx>


thanks,

Takashi