The err: path of ncm_wrap_ntb() frees ncm->skb_tx_data and ncm->skb_tx_ndp but never clears the pointers. The rest of the file treats NULL as "no aggregation in progress", and the other release site, package_for_tx(), clears them after freeing. When the NTH skb allocation succeeds but the NDP skb allocation fails -- both GFP_ATOMIC, so this happens under memory pressure -- the err: path frees both skbs and leaves stale pointers. The next transmit passes the guard on the freed skb_tx_data, reads ->len from the freed skb, and package_for_tx() may then write the NTB header through the freed skb's ->data: BUG: KASAN: slab-use-after-free in ncm_wrap_ntb (drivers/usb/gadget/function/f_ncm.c:1044) Read of size 4 at addr ffff888108582930 by task kworker/1:2/1623 Call Trace: ncm_wrap_ntb (drivers/usb/gadget/function/f_ncm.c:1044) eth_start_xmit (drivers/usb/gadget/function/u_ether.c:543) __dev_queue_xmit (net/core/dev.c:4884) Freed by task 4999: napi_skb_cache_put (net/core/skbuff.c:1471) /* deferred dev_kfree_skb_any() from err: */ net_tx_action (net/core/dev.c:5854) The buggy address belongs to the object at ffff8881085828c0 which belongs to the cache skbuff_head_cache of size 240 Clear both pointers after freeing so the next transmit re-enters the allocation branch on a clean state instead of dereferencing freed skbs. Fixes: 6d3865f9d41f ("usb: gadget: NCM: Add transmit multi-frame.") Cc: stable@vger.kernel.org Reported-by: co+02480a85e1a0d4f5@bugs.sh Signed-off-by: Boyan Liu --- drivers/usb/gadget/function/f_ncm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 500c9c19c78b..be1c2fa36350 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1132,10 +1132,14 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port, if (skb) dev_kfree_skb_any(skb); - if (ncm->skb_tx_data) + if (ncm->skb_tx_data) { dev_kfree_skb_any(ncm->skb_tx_data); - if (ncm->skb_tx_ndp) + ncm->skb_tx_data = NULL; + } + if (ncm->skb_tx_ndp) { dev_kfree_skb_any(ncm->skb_tx_ndp); + ncm->skb_tx_ndp = NULL; + } return NULL; } -- 2.43.0