Re: [PATCH] net/9p/usbg: Fix use-after-free in disable_usb9pfs()

[Michael Grzeschik]

On Sun, Jun 07, 2026 at 09:01:16PM +0800, Yizhou Zhao wrote:
> disable_usb9pfs() frees the IN and OUT usb_request objects before it
> disables the corresponding endpoints. If either request is still queued,
> the later usb_ep_disable() call cancels the endpoint queue and the UDC
> driver can still access the already freed request.
> 
> With dummy_hcd and KASAN, this is reproducible by queueing the OUT
> request and then disconnecting the configfs gadget:
> 
>   BUG: KASAN: slab-use-after-free in dummy_disable+0x2b4/0x300
>   Read of size 8 at addr ffff888009702400 by task sh/1
>   usb_ep_disable+0x8e/0x1f0
>   usb9pfs_func_unbind+0x193/0x350
>   gadget_dev_desc_UDC_store+0x135/0x280
> 
> dummy_free_request() also warns because the request is freed while its
> queue entry is still linked.
> 
> Disable both endpoints before freeing the request objects. This lets
> usb_ep_disable() cancel any queued transfers and invoke the completion
> callback while the request storage is still valid. The request objects
> are then freed only after they have been removed from the endpoint
> queues.

Acked-by: Michael Grzeschik <mgr@xxxxxxxxxx>

> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Yizhou Zhao <zhaoyz24@xxxxxxxxxxxxxxxxxxxxx>
> Reported-by: Yuxiang Yang <yangyx22@xxxxxxxxxxxxxxxxxxxxx>
> Reported-by: Ao Wang <wangao@xxxxxxxxxx>
> Reported-by: Xuewei Feng <fengxw06@xxxxxxx>
> Reported-by: Qi Li <qli01@xxxxxxxxxxxxxxx>
> Reported-by: Ke Xu <xuke@xxxxxxxxxxxxxxx>
> Assisted-by: GLM:GLM-5.1
> Signed-off-by: Yizhou Zhao <zhaoyz24@xxxxxxxxxxxxxxxxxxxxx>
> ---
>  net/9p/trans_usbg.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c
> index 1ce70338999c..5d0d6add150e 100644
> --- a/net/9p/trans_usbg.c
> +++ b/net/9p/trans_usbg.c
> @@ -278,6 +278,9 @@ static void disable_usb9pfs(struct f_usb9pfs *usb9pfs)
>  	struct usb_composite_dev *cdev =
>  		usb9pfs->function.config->cdev;
>  
> +	disable_ep(cdev, usb9pfs->in_ep);
> +	disable_ep(cdev, usb9pfs->out_ep);
> +
>  	if (usb9pfs->in_req) {
>  		usb_ep_free_request(usb9pfs->in_ep, usb9pfs->in_req);
>  		usb9pfs->in_req = NULL;
> @@ -287,9 +290,6 @@ static void disable_usb9pfs(struct f_usb9pfs *usb9pfs)
>  		usb_ep_free_request(usb9pfs->out_ep, usb9pfs->out_req);
>  		usb9pfs->out_req = NULL;
>  	}
> -
> -	disable_ep(cdev, usb9pfs->in_ep);
> -	disable_ep(cdev, usb9pfs->out_ep);
>  	dev_dbg(&cdev->gadget->dev, "%s disabled\n",
>  		usb9pfs->function.name);
>  }
> -- 
> 2.43.0
>