Re: [PATCH] usb: cdns3: fix use-after-free in cdns3_gadget_exit()

[Fan Wu]

> On Sep 10, 2026, at 10:28, Peter Chen <peter.chen@xxxxxxxxxx> wrote:
> 
> We may cancel work before going to de-init. How about move them before
> 
> pm_runtime_put_autosuspend(cdns->dev);
> 
> 

Hi Peter,

Thanks for the review.

I think the work items need to be cancelled only after the gadget has
been quiesced. Moving the cancellations before
pm_runtime_put_autosuspend() would run them while the gadget driver is
still bound and requests may still be queued.

In particular, an EP0 status request can queue pending_status_wq from
cdns3_gadget_ep0_queue(), and an endpoint request can queue
aligned_buf_wq from cdns3_prepare_aligned_request_buf(). Thus either
work can be re-queued after an early cancellation and before
usb_del_gadget() unbinds the gadget driver.

usb_del_gadget() performs the gadget unbind and synchronizes the gadget
IRQ; devm_free_irq() then removes the driver's IRQ handler. Keeping the
cancellations after these teardown steps ensures that both works are
drained before cdns3_free_all_eps() and the aligned buffers are freed.

Could we keep the current placement?

Thanks,
Fan