Re: [PATCH v1] usb: dwc3: gadget: fix gadget workqueue use-after-free

[Thinh Nguyen <Thinh.Nguyen@synopsys.com>]

On Wed, Jan 22, 2025, Roy Luo wrote:
> `dwc3_gadget_soft_disconnect` function, called as part of

The dwc3_gadget_soft_disconnect() isn't directly part of
device_del(&gadget->dev). It should be part of disconnect.

Can you provide the full sequence of events so I can have more context?
The handling of the flushing of gadget->work should not be part of the
dwc3.

> `device_del(&gadget->dev)`, queues a new work item to the gadget workqueue
> after the workqueue has been flushed in `usb_del_gadget`.
> This leads to a potential use-after-free issue.
> 
> To fix this, flush the workqueue in the `release` function before freeing
> the gadget. This ensures that all work items are processed before the
> gadget is destroyed.
> 
> Fixes: 1ff24d40b3c3 ("usb: dwc3: gadget: Fix incorrect UDC state after manual deconfiguration")

Since the patch above is now in the mainline, may need to add a stable
tag. 

Thanks,
Thinh

> Signed-off-by: Roy Luo <royluo@google.com>
> ---
>  drivers/usb/dwc3/gadget.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index d27af65eb08a..12055e3af622 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -4580,6 +4580,7 @@ static void dwc_gadget_release(struct device *dev)
>  {
>  	struct usb_gadget *gadget = container_of(dev, struct usb_gadget, dev);
>  
> +	flush_work(&gadget->work);
>  	kfree(gadget);
>  }
>  
> 
> base-commit: f066b5a6c7a06adfb666b7652cc99b4ff264f4ed
> -- 
> 2.48.0.rc2.279.g1de40edade-goog
>