From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f50.google.com (mail-ej1-f50.google.com [209.85.218.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2162543B6D9 for ; Thu, 30 Jul 2026 13:58:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785419915; cv=none; b=A7uvuKIrvQ4ehxqDmc04CSfyYZESWoHFXVpP42Ie5RwuchdlCPR51xKteAy28bNDEC//jQhaUdDawwq9muxtADUDpJvkBMz9BFAAKDGkoVu2Y6YjA9MSovB3A3ohzUbVUks5kMcuYBKh7xXGomL34MiQCCNWheasPt1AEZcLU2I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785419915; c=relaxed/simple; bh=AyDYZUkI4LxN1OwKn1gdfZzLnCy8TifSWUoCaFYc7dU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QohLmEkcXi66EUfwpBXx2j+jDQMvynEz8Q8rLG+UbgIiUol+Bf661HMRcRBHm5UrYvbg9kYi2gHJMdk8z6yEu5qIkC7EntdQekcLc8lEq///eAshJWTtz8TMev7z/CnToUuoJp5ngO7EGyjuT4UCQ/bKGX4VkkU0B6tuoW/T4Qc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cx/l9uME; arc=none smtp.client-ip=209.85.218.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cx/l9uME" Received: by mail-ej1-f50.google.com with SMTP id a640c23a62f3a-c1600d040e4so115514666b.1 for ; Thu, 30 Jul 2026 06:58:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785419912; x=1786024712; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=oeo+Ol5V0iJzFZJqhhNTD7gRBEjmwHyjPFI1Uq7A5sM=; b=cx/l9uMEzmG5GDELul4c0xZm8bJBUwBC/oBFFrj0JT8BGo5HLx5RTNLtwEc1qW1mHt FpB2bnY6QfuP+j8UzEzZI/avnbnr+5zXb/PUfhbc8fr4+B4n1XMCUng3RfSqlUBRHeiJ TRHNpV1LIoWsrlzbvbATQjiCWMEUwxLVbaayD+0Zfq/PIv43sa6rZFgQMNIYWUe28t3G 6SO+Zo6d9KKRIv6praWI0xxgm9dN+EYYWHypBYQUDAjZzgTpF6513r/GbOIbuoqTZhtU E989Uj9h3p8WYtHOc0+pH9cFgwneb0PLJishQMCFExU3tN0ZEyxpWllNtv+ipAOj7FqT 3Srg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785419912; x=1786024712; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oeo+Ol5V0iJzFZJqhhNTD7gRBEjmwHyjPFI1Uq7A5sM=; b=GsRcnnOG+mB/x7cTYJSZl9/qGRiXkgmwLnnOoIQuhNFoDfs4yXH8meQXg9+4vC1et+ XFeI5DWi8VTpx5rjbLiogvjMqUoRbQw/gB43hPz+NHcMY5QBqsXswAMeQg/ZoFu7xLtu iR9NIeYab6Gi7062v9VxiTXROLLgNylnDmQkuFgLppyGuIpGVY8uQ6TnXmLXTAKWy7g+ sDQteAAsBkt9pH/QTYRpVnQka2DiDtsDF6O06ujhkCUjkpiy4AuMIuPUMvij9+sFhLNb TYY/mLBG6UHnKy0T/d8vO/aKnupmhIGGpinBMl2IfBnHn1bqlZq2zRqFNsI/VWQK8GSj faPw== X-Forwarded-Encrypted: i=1; AHgh+RpjHIQdCWB1pnUKr4IZakp0j6Wtc4UPOw6d2hfwjRwZ8WJCBMTtmDZbayWnCRyJD1898zh/DeTiAnnAvMw=@vger.kernel.org X-Gm-Message-State: AOJu0YzR8Y/2ppPz/yh6vX6aU2i91+FMaD+kA+T0BMhU3pUO93PQ5ivi O5/kbW77VcpzavogLNn+hoxmNJndXQMxR9kUsdtLdRREst6t3180vyMn X-Gm-Gg: AR+sD10mYazuOPreqesj5GljNMrIL+57WTuRh6ngvcTZJPiJrxSnoqUpU7Kbl9++lKN OsxpAabHbBH4fuuQmJykPtloLLztGZYGpZ8OH8E6EtFHZADez39OrxrLLgz2OiCSuSrmDrjmWL9 QLz7ZEEyu8u1gQJyTUbXuf7/F/w5pME13I1vgKavrPx5UBlb33vrOejKQYr37BMrDSLK+Oxq6FZ e52xQ4za5g0kgPuqf1hQ3VG+GhtgAqQ/2dYimFv02xubmIuN4WO7v41D403p1SQEsPh53FGM59H erYLFa5gUxmG44heZRpdNqlKiQiqUTeHm1FiE08Yk+jXjrj96GInXd1WDpeQL92Uhdg4SPZF1zx ImP9Pmu2qjm2Q/WlT6UYBZkVyN5yZLTqvJJwuEzbrWwMK9Iog5sw/ZlREyy/38+lSvRSHlBEc72 sQGnJduBTX7AZCd9X90vpu8bK036MpwCwRRJV0Kghl1bU+5ws0lNTYMPeF6s3Ch9IZztywHqwNK HeryZ3R1y22EvMJoitdwrbQZD9WNAvwWXNcdVY1lrEWog34VkTwhWGFrKl22gag23dnErGBHo9t dp3KYauZfLq6UVUDwbfvYkDtvbXHYEPmsrvU10aJxxBsHVyq/VZTc2ha6xcpwRn6mEzwHAXhdxT KNS8ZmCnCt84tQ3HR2ZNd+bBIV96J1cRurTNBqcAJuUU3FiskWMWqdgnfq23+aIIIu4GDs7QDiC tFk8qpZaiaHOxYeDQ3wgeUjMgkJNH8G5g5xMdfi06GY2bJ2Ks7WLkpJJ1WAPPB1D/9XYCzLAJ+6 zi0Ig== X-Received: by 2002:a17:907:d0d:b0:c12:8a:7d7b with SMTP id a640c23a62f3a-c1fbd180da7mr28571566b.1.1785419911910; Thu, 30 Jul 2026 06:58:31 -0700 (PDT) Received: from cs-280612103108-default.europe-west4-b.c.oa7bb030819b2a894-tp.internal (73.138.178.34.bc.googleusercontent.com. [34.178.138.73]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fa851d495sm69164666b.2.2026.07.30.06.58.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Jul 2026 06:58:31 -0700 (PDT) From: Joshua Crofts To: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: midi2: remove default configfs groups on teardown Date: Thu, 30 Jul 2026 13:58:11 +0000 Message-ID: <20260730135811.1498-1-joshua.crofts1@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit f_midi2_alloc_inst() creates default configfs child groups for the default endpoint and default block using configfs_add_default_group(), setting their internal refcount to 1. However, during function teardown in f_midi2_free_inst() or EP cleanup in f_midi2_ep_opts_release(), configfs_remove_default_groups() is never called, therefore never dropping the refcount and leaking struct f_midi2_ep_opts and f_midi2_block_opts. Add the missing configfs_remove_default_groups() in the afformentioned functions to free the structs properly. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: Reported-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=eaa106d192c9daf37f95 Tested-by: syzbot+eaa106d192c9daf37f95@syzkaller.appspotmail.com Signed-off-by: Joshua Crofts --- Aside from testing the fix locally with QEMU and the reproducer, syzbot also reports no issues after running `syz test`. --- drivers/usb/gadget/function/f_midi2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c index 19fdac024..a4b72a6fa 100644 --- a/drivers/usb/gadget/function/f_midi2.c +++ b/drivers/usb/gadget/function/f_midi2.c @@ -2473,6 +2473,7 @@ static void f_midi2_ep_opts_release(struct config_item *item) { struct f_midi2_ep_opts *opts = to_f_midi2_ep_opts(item); + configfs_remove_default_groups(&opts->group); kfree(opts->info.ep_name); kfree(opts->info.product_id); kfree(opts); @@ -2639,6 +2640,7 @@ static void f_midi2_free_inst(struct usb_function_instance *f) opts = container_of(f, struct f_midi2_opts, func_inst); + configfs_remove_default_groups(&opts->func_inst.group); kfree(opts->info.iface_name); kfree(opts); } -- 2.47.3