[PATCH] net/9p/usbg: Fix use-after-free in usb9pfs_free_func

[PATCH] net/9p/usbg: Fix use-after-free in usb9pfs_free_func

[Yizhou Zhao]

In usb9pfs_free_func, kfree(usb9pfs) frees the entire f_usb9pfs
structure which contains the embedded usb_function member that the
parameter 'f' points to. After the kfree, the code accesses f->fi
via container_of(f->fi, struct f_usb9pfs_opts, func_inst) and later
calls usb_free_all_descriptors(f), both of which dereference the
freed memory. Since f is &usb9pfs->function, all post-kfree accesses
through f constitute use-after-free on the already-freed usb9pfs
allocation.

Move kfree(usb9pfs) to the end of the function so that all accesses
through f complete before the memory is freed.

Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: GLM:GLM-5.1
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c
index 1ce7033..c30ef5f 100644
--- a/net/9p/trans_usbg.c
+++ b/net/9p/trans_usbg.c
@@ -725,8 +725,6 @@ static void usb9pfs_free_func(struct usb_function *f)
 	struct f_usb9pfs *usb9pfs = func_to_usb9pfs(f);
 	struct f_usb9pfs_opts *opts;
 
-	kfree(usb9pfs);
-
 	opts = container_of(f->fi, struct f_usb9pfs_opts, func_inst);
 
 	mutex_lock(&opts->lock);
@@ -734,6 +732,8 @@ static void usb9pfs_free_func(struct usb_function *f)
 	mutex_unlock(&opts->lock);
 
 	usb_free_all_descriptors(f);
+
+	kfree(usb9pfs);
 }
 
 static int usb9pfs_set_alt(struct usb_function *f,

--
2.43.0

Re: [PATCH] net/9p/usbg: Fix use-after-free in usb9pfs_free_func

[Dominique Martinet]

Yizhou Zhao wrote on Fri, May 29, 2026 at 04:18:16PM +0800:
> In usb9pfs_free_func, kfree(usb9pfs) frees the entire f_usb9pfs
> structure which contains the embedded usb_function member that the
> parameter 'f' points to. After the kfree, the code accesses f->fi
> via container_of(f->fi, struct f_usb9pfs_opts, func_inst) and later
> calls usb_free_all_descriptors(f), both of which dereference the
> freed memory. Since f is &usb9pfs->function, all post-kfree accesses
> through f constitute use-after-free on the already-freed usb9pfs
> allocation.
> 
> Move kfree(usb9pfs) to the end of the function so that all accesses
> through f complete before the memory is freed.
> 
> Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
> Reported-by: Ao Wang <wangao@seu.edu.cn>
> Reported-by: Xuewei Feng <fengxw06@126.com>
> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
> Assisted-by: GLM:GLM-5.1
> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>

Thanks/sorry for the delay, I've picked this up for 7.4

There actually have been a duplicate of this commit a bit later with a
better commit message, so I've kept you as author as you were first, but
swapped the other's commit message in and added them as Co-developed-by

other mail
https://lore.kernel.org/r/20260731150414.3135662-1-nicoyip.dev@gmail.com

commit as of now
https://github.com/martinetd/linux/commit/0955472fff1e9f9e410a0300136924ebc8bd7a16
(look in https://github.com/martinetd/linux/commits/9p-test if commit is
gone on rebase)

-- 
Dominique Martinet | Asmadeus