[PATCH usb-gadget] usb: gadget: f_fs: clear stale priv->req/ep on DMA-BUF transfer completion

[PATCH usb-gadget] usb: gadget: f_fs: clear stale priv->req/ep on DMA-BUF transfer completion

[Zhenghang Xiao]

ffs_epfile_dmabuf_io_complete() frees the usb_request via
usb_ep_free_request() but never clears priv->req or priv->ep. When the
host later triggers endpoint disable (via SET_INTERFACE, disconnect, or
gadget unbind), the completion fires and frees req, leaving priv->req as
a dangling pointer. A subsequent close() or FUNCTIONFS_DMABUF_DETACH
ioctl then passes the stale pointer to usb_ep_dequeue(), resulting in a
use-after-free on the freed kmalloc-128 object.

Walk back from req->context to the ffs_dma_fence and its priv, then
clear priv->req and priv->ep before freeing the request. The cleanup
paths in ffs_epfile_release() and ffs_dmabuf_detach() already check for
NULL under eps_lock before calling usb_ep_dequeue().

Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
---
 drivers/usb/gadget/function/f_fs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 002c3441bea3..88d3e89c21b7 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1413,8 +1413,13 @@ static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret)
 static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep,
 					  struct usb_request *req)
 {
+	struct ffs_dma_fence *fence = req->context;
+	struct ffs_dmabuf_priv *priv = fence->priv;
+
 	pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status);
-	ffs_dmabuf_signal_done(req->context, req->status);
+	ffs_dmabuf_signal_done(fence, req->status);
+	priv->req = NULL;
+	priv->ep = NULL;
 	usb_ep_free_request(ep, req);
 }
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH usb-gadget] usb: gadget: f_fs: clear stale priv->req/ep on DMA-BUF transfer completion

[Greg Kroah-Hartman]

On Sat, May 23, 2026 at 11:27:39PM +0800, Zhenghang Xiao wrote:
> ffs_epfile_dmabuf_io_complete() frees the usb_request via
> usb_ep_free_request() but never clears priv->req or priv->ep. When the
> host later triggers endpoint disable (via SET_INTERFACE, disconnect, or
> gadget unbind), the completion fires and frees req, leaving priv->req as
> a dangling pointer. A subsequent close() or FUNCTIONFS_DMABUF_DETACH
> ioctl then passes the stale pointer to usb_ep_dequeue(), resulting in a
> use-after-free on the freed kmalloc-128 object.
> 
> Walk back from req->context to the ffs_dma_fence and its priv, then
> clear priv->req and priv->ep before freeing the request. The cleanup
> paths in ffs_epfile_release() and ffs_dmabuf_detach() already check for
> NULL under eps_lock before calling usb_ep_dequeue().
> 
> Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
> Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
> ---
>  drivers/usb/gadget/function/f_fs.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 002c3441bea3..88d3e89c21b7 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1413,8 +1413,13 @@ static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret)
>  static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep,
>  					  struct usb_request *req)
>  {
> +	struct ffs_dma_fence *fence = req->context;
> +	struct ffs_dmabuf_priv *priv = fence->priv;
> +
>  	pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status);
> -	ffs_dmabuf_signal_done(req->context, req->status);
> +	ffs_dmabuf_signal_done(fence, req->status);
> +	priv->req = NULL;
> +	priv->ep = NULL;
>  	usb_ep_free_request(ep, req);
>  }
>  
> -- 
> 2.50.1 (Apple Git-155)
> 
> 

Does not apply to the latest usb-linus tree, are you sure this is still
an issue on the latest release?

thanks,

greg k-h