From 5c69297356bf6d04d8222f52717c6c4aa73e5d2c Mon Sep 17 00:00:00 2001 From: Yizhou Zhao Date: Fri, 29 May 2026 16:10:25 +0800 Subject: [PATCH] net/9p/usbg: Fix use-after-free on usb9pfs_clear_tx When p9_usbg_close() is called, it invokes usb9pfs_clear_tx() but does not clear usb9pfs->client nor usb9pfs->in_req->context afterwards. The 9p client core (p9_client_destroy) calls close() and then kfree(clnt), so after p9_usbg_close returns the client struct is freed. If the USB gadget is later disabled (e.g., host disconnect), usb9pfs_disable calls usb9pfs_clear_tx again, which passes the dangling usb9pfs->client pointer to p9_client_cb. Inside p9_client_cb, p9_req_put(c, req) dereferences the freed client to access its reqs IDR, causing a use-after-free. Additionally, usb9pfs_clear_tx does not clear usb9pfs->in_req->context after calling p9_client_cb, so a second invocation finds a stale request pointer and attempts double-completion, further compounding the UAF risk. Fix by: 1. Clearing usb9pfs->in_req->context to NULL in usb9pfs_clear_tx() before checking usb9pfs->client, so that even if the client is gone the stale request pointer is consumed and cannot cause double-completion. 2. Adding a NULL check on usb9pfs->client in usb9pfs_clear_tx() to skip p9_client_cb() when the client has already been destroyed. 3. Setting usb9pfs->client = NULL in p9_usbg_close() after calling usb9pfs_clear_tx(), to prevent any subsequent call from dereferencing the freed client pointer. Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: GLM:GLM-5.1 Signed-off-by: Yizhou Zhao Message-ID: <20260529081026.77732-1-zhaoyz24@mails.tsinghua.edu.cn> Acked-by: Michael Grzeschik Signed-off-by: Dominique Martinet --- net/9p/trans_usbg.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c index 021631d63318..5f15e4249e84 100644 --- a/net/9p/trans_usbg.c +++ b/net/9p/trans_usbg.c @@ -435,6 +435,11 @@ static void usb9pfs_clear_tx(struct f_usb9pfs *usb9pfs) if (!req) return; + usb9pfs->in_req->context = NULL; + + if (!usb9pfs->client) + return; + if (!req->t_err) req->t_err = -ECONNRESET; @@ -457,6 +462,7 @@ static void p9_usbg_close(struct p9_client *client) client->status = Disconnected; usb9pfs_clear_tx(usb9pfs); + usb9pfs->client = NULL; opts = container_of(usb9pfs->function.fi, struct f_usb9pfs_opts, func_inst);