From: Tristan Madani f_audio_free() tears down the f_audio structure without cancelling playback_work or releasing audio buffers. The pending work can access the freed structure, and queued audio buffers leak. Additionally, f_audio_set_alt() and f_audio_out_ep_complete() transfer copy_buf to play_queue without clearing audio->copy_buf. When playback_work later consumes the buffer from the queue, audio->copy_buf becomes a stale reference. Clear audio->copy_buf when its buffer is queued to play_queue, so the pointer reliably reflects ownership. In f_audio_free(), cancel playback_work, drain the play_queue, and free copy_buf when it was not queued. Use IS_ERR_OR_NULL for the copy_buf check because f_audio_buffer_alloc() returns ERR_PTR on failure and f_audio_set_alt() stores the result directly in audio->copy_buf. Fixes: c6994e6f067c ("USB: gadget: add USB Audio Gadget driver") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- Changes in v4: - Fix the root cause of the stale copy_buf reference: clear audio->copy_buf at the two sites that transfer ownership to play_queue (f_audio_out_ep_complete inside the spinlock, and f_audio_set_alt alt 0) so playback_work consuming the buffer can no longer leave a stale pointer (sashiko-bot) - Simplify f_audio_free drain: no buf == copy_buf comparison needed since copy_buf is now reliably NULL when its buffer is on the queue Changes in v3: - Guard copy_buf free with IS_ERR_OR_NULL because f_audio_buffer_alloc() returns ERR_PTR on failure (sashiko-bot) - Attempted to detect copy_buf during queue drain, but that missed the case where playback_work already consumed it Changes in v2: - Added play_queue drain and copy_buf free (sashiko-bot) drivers/usb/gadget/function/f_uac1_legacy.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c index 7c8d60c7e87d1..cba7b447b09e3 100644 --- a/drivers/usb/gadget/function/f_uac1_legacy.c +++ b/drivers/usb/gadget/function/f_uac1_legacy.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include @@ -338,6 +339,7 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req) if (audio_buf_size - copy_buf->actual < req->actual) { spin_lock_irq(&audio->lock); list_add_tail(©_buf->list, &audio->play_queue); + audio->copy_buf = NULL; spin_unlock_irq(&audio->lock); schedule_work(&audio->playback_work); copy_buf = f_audio_buffer_alloc(audio_buf_size); @@ -670,6 +672,7 @@ static int f_audio_set_alt(struct usb_function *f, unsigned intf, unsigned alt) if (copy_buf) { list_add_tail(©_buf->list, &audio->play_queue); + audio->copy_buf = NULL; schedule_work(&audio->playback_work); } } @@ -942,7 +945,15 @@ static void f_audio_free(struct usb_function *f) { struct f_audio *audio = func_to_audio(f); struct f_uac1_legacy_opts *opts; + struct f_audio_buf *buf, *tmp; + cancel_work_sync(&audio->playback_work); + list_for_each_entry_safe(buf, tmp, &audio->play_queue, list) { + list_del(&buf->list); + f_audio_buffer_free(buf); + } + if (!IS_ERR_OR_NULL(audio->copy_buf)) + f_audio_buffer_free(audio->copy_buf); gaudio_cleanup(&audio->card); opts = container_of(f->fi, struct f_uac1_legacy_opts, func_inst); kfree(audio); -- 2.47.3