usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind

stable inclusion
from stable-v5.10.44
commit 5cead896962d8b25dee8a8efc85b076572732b86
bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=406
CVE: NA

-------------------------------------------------

commit 6fc1db5e upstream.

During unbind, ffs_func_eps_disable() will be executed, resulting in
completion callbacks for any pending USB requests.  When using AIO,
irrespective of the completion status, io_data work is queued to
io_completion_wq to evaluate and handle the completed requests.  Since
work runs asynchronously to the unbind() routine, there can be a
scenario where the work runs after the USB gadget has been fully
removed, resulting in accessing of a resource which has been already
freed. (i.e. usb_ep_free_request() accessing the USB ep structure)

Explicitly drain the io_completion_wq, instead of relying on the
destroy_workqueue() (in ffs_data_put()) to make sure no pending
completion work items are running.
Signed-off-by: NWesley Cheng <wcheng@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1621644261-1236-1-git-send-email-wcheng@codeaurora.orgSigned-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Nliuhao <1107732331@qq.com>
Reviewed-by: NJian Cheng <cj.chengjian@huawei.com>
Signed-off-by: NWang ShaoBo <bobo.shaobowang@huawei.com>

drivers/usb/gadget/function/f_fs.c

@@ -3566,6 +3566,9 @@ static void ffs_func_unbind(struct usb_configuration *c,
 		ffs->func = NULL;
 	}
 
+	/* Drain any pending AIO completions */
+	drain_workqueue(ffs->io_completion_wq);
+
 	if (!--opts->refcnt)
 		functionfs_unbind(ffs);