From 0955472fff1e9f9e410a0300136924ebc8bd7a16 Mon Sep 17 00:00:00 2001 From: Yizhou Zhao Date: Fri, 29 May 2026 16:18:16 +0800 Subject: [PATCH] net/9p/usbg: fix descriptor cleanup use-after-free usb9pfs_free_func() frees the f_usb9pfs object before calling usb_free_all_descriptors(). The usb_function passed to the latter is embedded in the freed object, so removing the function from a gadget dereferences freed memory. The failing teardown sequence is: configfs unlink usb9pfs_free_func() kfree(usb9pfs) usb_free_all_descriptors(f) dereference the embedded usb_function KASAN reported: BUG: KASAN: slab-use-after-free in usb_free_all_descriptors+0x138/0x190 Read of size 8 at addr ffff888106a73088 by task poc/95 Call Trace: usb_free_all_descriptors+0x138/0x190 config_usb_cfg_unlink+0x1f0/0x2f0 configfs_unlink+0x321/0x6f0 Free the descriptors before freeing their containing object. Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: GLM:GLM-5.1 Signed-off-by: Yizhou Zhao Co-developed-by: Chengfeng Ye Signed-off-by: Chengfeng Ye Acked-by: Michael Grzeschik Message-ID: <20260529081817.77898-1-zhaoyz24@mails.tsinghua.edu.cn> Message-ID: <20260731150414.3135662-1-nicoyip.dev@gmail.com> Signed-off-by: Dominique Martinet --- net/9p/trans_usbg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c index 419cda13a7b5..23056b803ddf 100644 --- a/net/9p/trans_usbg.c +++ b/net/9p/trans_usbg.c @@ -725,8 +725,6 @@ static void usb9pfs_free_func(struct usb_function *f) struct f_usb9pfs *usb9pfs = func_to_usb9pfs(f); struct f_usb9pfs_opts *opts; - kfree(usb9pfs); - opts = container_of(f->fi, struct f_usb9pfs_opts, func_inst); mutex_lock(&opts->lock); @@ -734,6 +732,8 @@ static void usb9pfs_free_func(struct usb_function *f) mutex_unlock(&opts->lock); usb_free_all_descriptors(f); + + kfree(usb9pfs); } static int usb9pfs_set_alt(struct usb_function *f,