Patch "usb: gadget: u_audio: Free requests only after callback" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: gadget: u_audio: Free requests only after callback

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-u_audio-free-requests-only-after-callback.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ca13a9a6137f77b9ae7d7ec5c624bc38a8707409
Author: Jack Pham <jackp@xxxxxxxxxxxxxx>
Date:   Mon Jan 18 09:46:39 2021 +0100

    usb: gadget: u_audio: Free requests only after callback
    
    [ Upstream commit 7de8681be2cde9f6953d3be1fa6ce05f9fe6e637 ]
    
    As per the kernel doc for usb_ep_dequeue(), it states that "this
    routine is asynchronous, that is, it may return before the completion
    routine runs". And indeed since v5.0 the dwc3 gadget driver updated
    its behavior to place dequeued requests on to a cancelled list to be
    given back later after the endpoint is stopped.
    
    The free_ep() was incorrectly assuming that a request was ready to
    be freed after calling dequeue which results in a use-after-free
    in dwc3 when it traverses its cancelled list. Fix this by moving
    the usb_ep_free_request() call to the callback itself in case the
    ep is disabled.
    
    Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
    Reported-and-tested-by: Ferry Toth <fntoth@xxxxxxxxx>
    Reviewed-and-tested-by: Peter Chen <peter.chen@xxxxxxx>
    Acked-by: Felipe Balbi <balbi@xxxxxxxxxx>
    Signed-off-by: Jack Pham <jackp@xxxxxxxxxxxxxx>
    Signed-off-by: Jerome Brunet <jbrunet@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@xxxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index 56906d15fb551..223029fa84459 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 	struct snd_uac_chip *uac = prm->uac;
 
 	/* i/f shutting down */
-	if (!prm->ep_enabled || req->status == -ESHUTDOWN)
+	if (!prm->ep_enabled) {
+		usb_ep_free_request(ep, req);
+		return;
+	}
+
+	if (req->status == -ESHUTDOWN)
 		return;
 
 	/*
@@ -351,8 +356,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
 
 	for (i = 0; i < params->req_number; i++) {
 		if (prm->ureq[i].req) {
-			usb_ep_dequeue(ep, prm->ureq[i].req);
-			usb_ep_free_request(ep, prm->ureq[i].req);
+			if (usb_ep_dequeue(ep, prm->ureq[i].req))
+				usb_ep_free_request(ep, prm->ureq[i].req);
+			/*
+			 * If usb_ep_dequeue() cannot successfully dequeue the
+			 * request, the request will be freed by the completion
+			 * callback.
+			 */
+
 			prm->ureq[i].req = NULL;
 		}
 	}