Patch "ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-usb-audio-avoid-dropping-midi-events-at-closing.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 17ae2db9ddc87e5933169d11a45bc965e3d47cbb
Author: Takashi Iwai <tiwai@xxxxxxx>
Date:   Tue Feb 18 12:40:24 2025 +0100

    ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
    
    [ Upstream commit a3bdd8f5c2217e1cb35db02c2eed36ea20fb50f5 ]
    
    We fixed the UAF issue in USB MIDI code by canceling the pending work
    at closing each MIDI output device in the commit below.  However, this
    assumed that it's the only one that is tied with the endpoint, and it
    resulted in unexpected data truncations when multiple devices are
    assigned to a single endpoint and opened simultaneously.
    
    For addressing the unexpected MIDI message drops, simply replace
    cancel_work_sync() with flush_work().  The drain callback should have
    been already invoked before the close callback, hence the port->active
    flag must be already cleared.  So this just assures that the pending
    work is finished before freeing the resources.
    
    Fixes: 0125de38122f ("ALSA: usb-audio: Cancel pending work at closing a MIDI substream")
    Reported-and-tested-by: John Keeping <jkeeping@xxxxxxxxxxxxxxxxx>
    Closes: https://lore.kernel.org/20250217111647.3368132-1-jkeeping@xxxxxxxxxxxxxxxxx
    Link: https://patch.msgid.link/20250218114024.23125-1-tiwai@xxxxxxx
    Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 9a361b202a09d..a56c1a69b422a 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1145,7 +1145,7 @@ static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
 {
 	struct usbmidi_out_port *port = substream->runtime->private_data;
 
-	cancel_work_sync(&port->ep->work);
+	flush_work(&port->ep->work);
 	return substream_open(substream, 0, 0);
 }