Re: [PATCH] net/9p/usbg: fix descriptor cleanup use-after-free

On Fri, Jul 31, 2026 at 11:04:14PM +0800, Chengfeng Ye wrote:
> usb9pfs_free_func() frees the f_usb9pfs object before calling
> usb_free_all_descriptors().  The usb_function passed to the latter is
> embedded in the freed object, so removing the function from a gadget
> dereferences freed memory.
> 
> The failing teardown sequence is:
> 
>   configfs unlink
>     usb9pfs_free_func()
>       kfree(usb9pfs)
>       usb_free_all_descriptors(f)
>         dereference the embedded usb_function
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in usb_free_all_descriptors+0x138/0x190
>   Read of size 8 at addr ffff888106a73088 by task poc/95
>   Call Trace:
>    usb_free_all_descriptors+0x138/0x190
>    config_usb_cfg_unlink+0x1f0/0x2f0
>    configfs_unlink+0x321/0x6f0
> 
> Free the descriptors before freeing their containing object.

Although this is a copy of https://lore.kernel.org/all/[email protected]/
which actually came earlier than your, I like the commit message here better.

Acked-by: Michael Grzeschik <[email protected]>

> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: [email protected]
> Signed-off-by: Chengfeng Ye <[email protected]>
> ---
>  net/9p/trans_usbg.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c
> index 419cda13a7b5..8c2f0d8592c8 100644
> --- a/net/9p/trans_usbg.c
> +++ b/net/9p/trans_usbg.c
> @@ -725,8 +725,6 @@ static void usb9pfs_free_func(struct usb_function *f)
>  	struct f_usb9pfs *usb9pfs = func_to_usb9pfs(f);
>  	struct f_usb9pfs_opts *opts;
>  
> -	kfree(usb9pfs);
> -
>  	opts = container_of(f->fi, struct f_usb9pfs_opts, func_inst);
>  
>  	mutex_lock(&opts->lock);
> @@ -734,6 +732,7 @@ static void usb9pfs_free_func(struct usb_function *f)
>  	mutex_unlock(&opts->lock);
>  
>  	usb_free_all_descriptors(f);
> +	kfree(usb9pfs);
>  }
>  
>  static int usb9pfs_set_alt(struct usb_function *f,