Re: [PATCH] usb: cdns3: fix use-after-free in cdns3_gadget_exit()

[Peter Chen]

On 26-09-10 13:50:46, Fan Wu wrote:
> > On Sep 10, 2026, at 10:28, Peter Chen <peter.chen@xxxxxxxxxx> wrote:
> > 
> > We may cancel work before going to de-init. How about move them before
> > 
> > pm_runtime_put_autosuspend(cdns->dev);
> > 
> > 
> 
> Hi Peter,
> 
> Thanks for the review.
> 
> I think the work items need to be cancelled only after the gadget has
> been quiesced. Moving the cancellations before
> pm_runtime_put_autosuspend() would run them while the gadget driver is
> still bound and requests may still be queued.
> 
> In particular, an EP0 status request can queue pending_status_wq from
> cdns3_gadget_ep0_queue(), and an endpoint request can queue
> aligned_buf_wq from cdns3_prepare_aligned_request_buf(). Thus either
> work can be re-queued after an early cancellation and before
> usb_del_gadget() unbinds the gadget driver.
> 
> usb_del_gadget() performs the gadget unbind and synchronizes the gadget
> IRQ; devm_free_irq() then removes the driver's IRQ handler. Keeping the
> cancellations after these teardown steps ensures that both works are
> drained before cdns3_free_all_eps() and the aligned buffers are freed.
> 
> Could we keep the current placement?

Sure, your comment is reasonable.

-- 

Thanks,
Peter Chen