Re: [PATCH] usb: gadget: f_fs: fix use-after-free of ffs_dev in ffs_free_inst()

[sashiko-bot@kernel.org]

> When a function instance is removed through configfs, ffs_free_inst()
> first calls ffs_release_dev(), which takes ffs_dev_lock, detaches the
> dev from its mount and drops the lock again. Only then does it retake
> the lock and free the dev with _ffs_free_dev().
> 
> Between those two steps the dev is still on the ffs_devices list. If
> someone mounts functionfs with the same instance name right then,
> ffs_acquire_dev() finds the dev, marks it mounted and points the new
> ffs_data at it. The dev is freed a moment later, and when that mount
> is torn down, ffs_closed() writes to freed memory. syzbot hit this:
> 
>   BUG: KASAN: slab-use-after-free in ffs_closed drivers/usb/gadget/function/f_fs.c:4427 [inline]
>   BUG: KASAN: slab-use-after-free in ffs_data_clear+0x543/0x5b0 drivers/usb/gadget/function/f_fs.c:2305
>   Write of size 1 at addr ffff8880237b1e4a by task syz-executor/11910
>   Call Trace:
> [ ... ]
> Fixes: ecfbd7b9054b ("usb: gadget: f_fs: Fix setting of device and driver data cross-references")
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+6227549bd2c8a1ec8ba0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6227549bd2c8a1ec8ba0
> Signed-off-by: Palla Raghunath <raghunathpalla.0209@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006204202.59604-1-raghunathpalla.0209@gmail.com?part=1