From e6542ac0fd85d9aaa9ed63df69e508f5db24ad55 Mon Sep 17 00:00:00 2001 From: Zhihong Chen Date: Wed, 19 Aug 2026 12:51:05 +0800 Subject: [PATCH 1/3] [fix] osal: defer Zephyr thread memory release - The system workqueue may preempt a self-deleting thread after the release work is submitted. Waiting for the thread with k_thread_join() before freeing its TCB and stack prevents use-after-free corruption. - Also handle release work allocation failure before aborting the thread. Signed-off-by: Zhihong Chen --- osal/usb_osal_zephyr.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/osal/usb_osal_zephyr.c b/osal/usb_osal_zephyr.c index fe2dc641..6b2a0fa4 100644 --- a/osal/usb_osal_zephyr.c +++ b/osal/usb_osal_zephyr.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025, sakumisu + * Copyright (c) 2025-2026 sakumisu * * SPDX-License-Identifier: Apache-2.0 */ @@ -48,8 +48,12 @@ usb_osal_thread_t usb_osal_thread_create(const char *name, uint32_t stack_size, static void release_thread_handler(struct k_work *work) { struct release_thread_work *release_work = (struct release_thread_work *)work; - k_free(release_work->thread); - k_work_cancel(work); + + /* The workqueue may preempt the thread that queued this work. Wait until + * k_thread_abort() has completed before freeing its TCB and stack. */ + if (k_thread_join(release_work->thread, K_FOREVER) == 0) { + k_free(release_work->thread); + } k_free(release_work); } @@ -63,6 +67,10 @@ void usb_osal_thread_delete(usb_osal_thread_t thread) thread = z_current_get(); #endif release_work = k_malloc(sizeof(struct release_thread_work)); + if (release_work == NULL) { + k_thread_abort(thread); + return; + } release_work->thread = thread; k_work_init(&release_work->work, release_thread_handler); k_work_submit(&release_work->work); @@ -309,4 +317,4 @@ void *usb_osal_malloc(size_t size) void usb_osal_free(void *ptr) { k_free(ptr); -} \ No newline at end of file +} From 5ab3e4f20beb54ceb6f0a6efb46abef8602f4cb4 Mon Sep 17 00:00:00 2001 From: Zhihong Chen Date: Wed, 19 Aug 2026 12:55:23 +0800 Subject: [PATCH 2/3] [update] platform: zephyr: add MSC application lifecycle hooks - Add weak usbh_msc_app_run() and usbh_msc_app_stop() callbacks to the Zephyr MSC disk adapter. - Invoke the application start callback after registering the disk and the stop callback before unregistering it, allowing samples to mount and unmount filesystems without modifying the CherryUSB class driver. Signed-off-by: Zhihong Chen --- platform/zephyr/usbh_msc_disk.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/platform/zephyr/usbh_msc_disk.c b/platform/zephyr/usbh_msc_disk.c index 6890f985..0223a9ee 100644 --- a/platform/zephyr/usbh_msc_disk.c +++ b/platform/zephyr/usbh_msc_disk.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2025, sakumisu + * Copyright (c) 2025-2026 sakumisu * * SPDX-License-Identifier: Apache-2.0 */ @@ -131,12 +131,26 @@ static struct disk_info usbh_msc_disk = { .ops = &msc_disk_ops, }; +__WEAK void usbh_msc_app_run(struct usbh_msc *msc_class) +{ + (void)msc_class; +} + +__WEAK void usbh_msc_app_stop(struct usbh_msc *msc_class) +{ + (void)msc_class; +} + void usbh_msc_run(struct usbh_msc *msc_class) { disk_access_register(&usbh_msc_disk); + + usbh_msc_app_run(msc_class); } void usbh_msc_stop(struct usbh_msc *msc_class) { + usbh_msc_app_stop(msc_class); + disk_access_unregister(&usbh_msc_disk); -} \ No newline at end of file +} From e7f7564871e3f6831adf32e1ba3e7710352dfeda Mon Sep 17 00:00:00 2001 From: Zhihong Chen Date: Wed, 19 Aug 2026 13:00:10 +0800 Subject: [PATCH 3/3] [update] port: hpmicro: remove sdk version check Signed-off-by: Zhihong Chen --- port/hpmicro/usb_dc_hpm.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/port/hpmicro/usb_dc_hpm.c b/port/hpmicro/usb_dc_hpm.c index 60af1187..8ece72a3 100644 --- a/port/hpmicro/usb_dc_hpm.c +++ b/port/hpmicro/usb_dc_hpm.c @@ -7,11 +7,6 @@ #include "usbd_core.h" #include "hpm_usb_device.h" #include "usb_glue_hpm.h" -#include "hpm_sdk_version.h" - -#if SDK_VERSION_NUMBER < 0x10C00 -#error "Please use SDK version 1.12.0 or later because of USB api modification" -#endif #define USB_NUM_BIDIR_ENDPOINTS USB_SOC_DCD_MAX_ENDPOINT_COUNT