Re: [PATCH] usb: gadget: f_phonet: don't free the net_device on failed registration

[sashiko-bot@kernel.org]

> From: Nicholas Velten <nicholasfvelten@gmail.com>
> 
> gphonet_register_netdev() frees the net_device when register_netdev()
> fails. That made sense when the device was registered once at module
> load, but since the conversion to the function interface the device is
> allocated in phonet_alloc_inst(), stored in phonet_opts->net and
> registered from pn_bind(), which only sets phonet_opts->bound on
> success. After a failed registration opts->net therefore points to
> freed memory, and the next bind writes to it in gphonet_set_gadget():
> 
>   BUG: KASAN: slab-use-after-free in pn_bind+0x49a/0x500
>   Write of size 8 at addr ffff888003e785d8 by task gadget_rereg/86
>   Call Trace:
>    pn_bind
>    usb_add_function
> [ ... ]
> Fixes: fcbdf12ebef7 ("usb: gadget: f_phonet: convert to new function interface with backward compatibility")
> Reported-by: syzbot+098999e05b6b877c01b3@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=098999e05b6b877c01b3
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Nicholas Velten <nicholasfvelten@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-fix-phonet-free-on-failure-v1-1-3c93c48e7527@gmail.com?part=1