From: sashiko-bot@kernel.org
To: "Eduard Zateev" <hackerowskiy@gmail.com>
Cc: linux-usb@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: f_fs: fix use-after-free on umount
Date: Thu, 08 Oct 2026 00:49:35 +0000 [thread overview]
Message-ID: <sashiko-outbox-163481@kernel.org> (raw)
In-Reply-To: <20261008003955.1191-1-hackerowskiy@gmail.com>
> ffs_free_inst() releases a device and drops ffs_dev_lock before it
> removes and frees the device. A concurrent FunctionFS mount can find
> the released device in that window, attach a new ffs_data to it, and
> then use the freed device from ffs_closed() during unmount.
>
> Keep ffs_dev_lock held across release and free so a new mount cannot
> attach to a device being torn down. In ffs_data_put(), read
> ffs->private_data only after acquiring the same lock, since a concurrent
> ffs_free_inst() may clear and free the referenced device while the
> putter waits for the lock.
>
> Fixes: ecfbd7b9054b ("usb: gadget: f_fs: Fix setting of device and driver data cross-references")
>
> Reported-by: syzbot+6227549bd2c8a1ec8ba0@syzkaller.appspotmail.com
>
> Link: https://syzkaller.appspot.com/bug?extid=6227549bd2c8a1ec8ba0
> Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261008003955.1191-1-hackerowskiy@gmail.com?part=1
prev parent reply other threads:[~2026-10-08 0:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 0:39 [PATCH] usb: gadget: f_fs: fix use-after-free on umount Eduard Zateev
2026-10-08 0:49 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-163481@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=hackerowskiy@gmail.com \
--cc=linux-usb@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.