On Wed, Jan 22, 2025, Roy Luo wrote:
> `dwc3_gadget_soft_disconnect` function, called as part of
The dwc3_gadget_soft_disconnect() isn't directly part of
device_del(&gadget->dev). It should be part of disconnect.
Can you provide the full sequence of events so I can have more context?
The handling of the flushing of gadget->work should not be part of the
dwc3.
> `device_del(&gadget->dev)`, queues a new work item to the gadget workqueue
> after the workqueue has been flushed in `usb_del_gadget`.
> This leads to a potential use-after-free issue.
>
> To fix this, flush the workqueue in the `release` function before freeing
> the gadget. This ensures that all work items are processed before the
> gadget is destroyed.
>
> Fixes: 1ff24d40b3c3 ("usb: dwc3: gadget: Fix incorrect UDC state after manual deconfiguration")
Since the patch above is now in the mainline, may need to add a stable
tag.
Thanks,
Thinh
> Signed-off-by: Roy Luo <royluo@xxxxxxxxxx>
> ---
> drivers/usb/dwc3/gadget.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index d27af65eb08a..12055e3af622 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -4580,6 +4580,7 @@ static void dwc_gadget_release(struct device *dev)
> {
> struct usb_gadget *gadget = container_of(dev, struct usb_gadget, dev);
>
> + flush_work(&gadget->work);
> kfree(gadget);
> }
>
>
> base-commit: f066b5a6c7a06adfb666b7652cc99b4ff264f4ed
> --
> 2.48.0.rc2.279.g1de40edade-goog
>
