github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net/9p/usbg: fix descriptor cleanup use-after-free

Browse Source 
usb9pfs_free_func() frees the f_usb9pfs object before calling
usb_free_all_descriptors().  The usb_function passed to the latter is
embedded in the freed object, so removing the function from a gadget
dereferences freed memory.

The failing teardown sequence is:

  configfs unlink
    usb9pfs_free_func()
      kfree(usb9pfs)
      usb_free_all_descriptors(f)
        dereference the embedded usb_function

KASAN reported:

  BUG: KASAN: slab-use-after-free in usb_free_all_descriptors+0x138/0x190
  Read of size 8 at addr ffff888106a73088 by task poc/95
  Call Trace:
   usb_free_all_descriptors+0x138/0x190
   config_usb_cfg_unlink+0x1f0/0x2f0
   configfs_unlink+0x321/0x6f0

Free the descriptors before freeing their containing object.

Fixes: a3be076dc1 ("net/9p/usbg: Add new usb gadget function transport")
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: GLM:GLM-5.1
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Co-developed-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Acked-by: Michael Grzeschik <mgr@kernel.org>
Message-ID: <20260529081817.77898-1-zhaoyz24@mails.tsinghua.edu.cn>
Message-ID: <20260731150414.3135662-1-nicoyip.dev@gmail.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
This commit is contained in:
Yizhou Zhao 2026-05-29 16:18:16 +08:00 committed by Dominique Martinet
parent 7fb9bd3659
commit 0955472fff
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/9p/trans_usbg.c
View File

@ -725,8 +725,6 @@ static void usb9pfs_free_func(struct usb_function *f)
struct f_usb9pfs *usb9pfs = func_to_usb9pfs(f);
struct f_usb9pfs_opts *opts;
kfree(usb9pfs);
opts = container_of(f->fi, struct f_usb9pfs_opts, func_inst);
mutex_lock(&opts->lock);
@ -734,6 +732,8 @@ static void usb9pfs_free_func(struct usb_function *f)
mutex_unlock(&opts->lock);
usb_free_all_descriptors(f);
kfree(usb9pfs);
}
static int usb9pfs_set_alt(struct usb_function *f,