Re: [PATCH] net/9p/usbg: fix descriptor cleanup use-after-free

[Dominique Martinet]

Chengfeng Ye wrote on Fri, Jul 31, 2026 at 11:04:14PM +0800:
> usb9pfs_free_func() frees the f_usb9pfs object before calling
> usb_free_all_descriptors().  The usb_function passed to the latter is
> embedded in the freed object, so removing the function from a gadget
> dereferences freed memory.
> 
> The failing teardown sequence is:
> 
>   configfs unlink
>     usb9pfs_free_func()
>       kfree(usb9pfs)
>       usb_free_all_descriptors(f)
>         dereference the embedded usb_function
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in usb_free_all_descriptors+0x138/0x190
>   Read of size 8 at addr ffff888106a73088 by task poc/95
>   Call Trace:
>    usb_free_all_descriptors+0x138/0x190
>    config_usb_cfg_unlink+0x1f0/0x2f0
>    configfs_unlink+0x321/0x6f0
> 
> Free the descriptors before freeing their containing object.
> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>

Thanks for the patch, given there was another identical patch earlier
but Michael preferred your commit message I've kept the original patch
with your commit message, keeping you as Co-developed-by

It should get in 7.4 if I'm not hit by a bus

other mail
https://lore.kernel.org/r/20260529081817.77898-1-zhaoyz24@xxxxxxxxxxxxxxxxxxxxx

commit as of now
https://github.com/martinetd/linux/commit/0955472fff1e9f9e410a0300136924ebc8bd7a16
(look in https://github.com/martinetd/linux/commits/9p-test if commit is
gone on rebase)

-- 
Dominique Martinet | Asmadeus