[PATCH v2] usb: gadget: f_uac1_legacy: cancel playback_work and drain buffers on free

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

f_audio_free() calls kfree(audio) without cancelling playback_work or
freeing the queued audio buffers.  If a playback work item is pending
or running when the function is freed, the work handler references
the already-freed audio structure via container_of.  Additionally, any
f_audio_buf entries remaining on play_queue and the partially filled
copy_buf are not freed.

Cancel the pending work, drain all queued buffers from play_queue, and
free copy_buf before cleaning up the ALSA card and freeing the audio
structure.

Fixes: c6994e6f067c ("USB: gadget: add USB Audio Gadget driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v2:
- Drain queued f_audio_buf entries from play_queue and free copy_buf
  before kfree, addressing sashiko-bot [Medium] buffer leak concern

 drivers/usb/gadget/function/f_uac1_legacy.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
index 7c8d60c7e87d1..9fab3f9c8b9d6 100644
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -942,7 +942,15 @@ static void f_audio_free(struct usb_function *f)
 {
 	struct f_audio *audio = func_to_audio(f);
 	struct f_uac1_legacy_opts *opts;
+	struct f_audio_buf *buf, *tmp;
 
+	cancel_work_sync(&audio->playback_work);
+	list_for_each_entry_safe(buf, tmp, &audio->play_queue, list) {
+		list_del(&buf->list);
+		f_audio_buffer_free(buf);
+	}
+	if (audio->copy_buf)
+		f_audio_buffer_free(audio->copy_buf);
 	gaudio_cleanup(&audio->card);
 	opts = container_of(f->fi, struct f_uac1_legacy_opts, func_inst);
 	kfree(audio);
-- 
2.47.3