Re: [PATCH] usb: gadget: f_fs: fix use-after-free of ffs_dev in ffs_free_inst()

[Michał Nazarewicz]

On Tue, Oct 06 2026, Palla Raghunath wrote:
> When a function instance is removed through configfs, ffs_free_inst()
> first calls ffs_release_dev(), which takes ffs_dev_lock, detaches the
> dev from its mount and drops the lock again. Only then does it retake
> the lock and free the dev with _ffs_free_dev().

> Fixes: ecfbd7b9054b ("usb: gadget: f_fs: Fix setting of device and driver data cross-references")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: syzbot+6227549bd2c8a1ec8ba0@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=6227549bd2c8a1ec8ba0
> Signed-off-by: Palla Raghunath <raghunathpalla.0209@xxxxxxxxx>

Acked-by: Michał Nazarewicz <mina86@xxxxxxxxxx>

> ---
>  drivers/usb/gadget/function/f_fs.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index c64a268e98a4..f8ea9a980605 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -288,6 +288,7 @@ static struct ffs_dev *_ffs_find_dev(const char *name);
>  static struct ffs_dev *_ffs_alloc_dev(void);
>  static void _ffs_free_dev(struct ffs_dev *dev);
>  static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data);
> +static void _ffs_release_dev(struct ffs_dev *ffs_dev);
>  static void ffs_release_dev(struct ffs_dev *ffs_dev);
>  static int ffs_ready(struct ffs_data *ffs);
>  static void ffs_closed(struct ffs_data *ffs);
> @@ -4147,8 +4148,8 @@ static void ffs_free_inst(struct usb_function_instance *f)
>  	struct f_fs_opts *opts;
>  
>  	opts = to_f_fs_opts(f);
> -	ffs_release_dev(opts->dev);
>  	ffs_dev_lock();
> +	_ffs_release_dev(opts->dev);
>  	_ffs_free_dev(opts->dev);
>  	ffs_dev_unlock();
>  	kfree(opts);
> @@ -4363,10 +4364,11 @@ static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data)
>  	return ret;
>  }
>  
> -static void ffs_release_dev(struct ffs_dev *ffs_dev)
> +/*
> + * Same as ffs_release_dev(), for callers that already hold ffs_dev_lock.
> + */
> +static void _ffs_release_dev(struct ffs_dev *ffs_dev)
>  {
> -	ffs_dev_lock();
> -
>  	if (ffs_dev && ffs_dev->mounted) {
>  		ffs_dev->mounted = false;
>  		if (ffs_dev->ffs_data) {
> @@ -4377,7 +4379,12 @@ static void ffs_release_dev(struct ffs_dev *ffs_dev)
>  		if (ffs_dev->ffs_release_dev_callback)
>  			ffs_dev->ffs_release_dev_callback(ffs_dev);
>  	}
> +}
>  
> +static void ffs_release_dev(struct ffs_dev *ffs_dev)
> +{
> +	ffs_dev_lock();
> +	_ffs_release_dev(ffs_dev);
>  	ffs_dev_unlock();
>  }

-- 
Best regards
ミハウ “𝓶𝓲𝓷𝓪86” ナザレヴィツ
«If at first you don’t succeed, give up skydiving»