Patch "ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-usb-audio-avoid-dropping-midi-events-at-closing.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e9a08b012287732775ecce6553b409c0d43e9f11
Author: Takashi Iwai <tiwai@xxxxxxx>
Date:   Tue Feb 18 12:40:24 2025 +0100

    ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
    
    [ Upstream commit a3bdd8f5c2217e1cb35db02c2eed36ea20fb50f5 ]
    
    We fixed the UAF issue in USB MIDI code by canceling the pending work
    at closing each MIDI output device in the commit below.  However, this
    assumed that it's the only one that is tied with the endpoint, and it
    resulted in unexpected data truncations when multiple devices are
    assigned to a single endpoint and opened simultaneously.
    
    For addressing the unexpected MIDI message drops, simply replace
    cancel_work_sync() with flush_work().  The drain callback should have
    been already invoked before the close callback, hence the port->active
    flag must be already cleared.  So this just assures that the pending
    work is finished before freeing the resources.
    
    Fixes: 0125de38122f ("ALSA: usb-audio: Cancel pending work at closing a MIDI substream")
    Reported-and-tested-by: John Keeping <jkeeping@xxxxxxxxxxxxxxxxx>
    Closes: https://lore.kernel.org/20250217111647.3368132-1-jkeeping@xxxxxxxxxxxxxxxxx
    Link: https://patch.msgid.link/20250218114024.23125-1-tiwai@xxxxxxx
    Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 737dd00e97b14..779d97d31f170 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1145,7 +1145,7 @@ static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
 {
 	struct usbmidi_out_port *port = substream->runtime->private_data;
 
-	cancel_work_sync(&port->ep->work);
+	flush_work(&port->ep->work);
 	return substream_open(substream, 0, 0);
 }