Re: [PATCH usb-next] usb: gadget: f_rndis: prevent double-free of OS descriptor table

[sashiko-bot@kernel.org]

> rndis_bind() allocates an OS descriptor table only when
> cdev->use_os_string is enabled. However, rndis_unbind() frees the
> table and resets f->os_desc_n without clearing f->os_desc_table,
> leaving a dangling pointer.
> 
> When a ConfigFS gadget is unbound, the function object can be reused
> for a subsequent bind. OS descriptor support can be toggled through
> the ConfigFS os_desc/use attribute, which determines
> cdev->use_os_string on the next bind. If this flag changes from true
> to false between binds, rndis_bind() skips the allocation and leaves
> f->os_desc_table pointing to the previously freed memory.
> 
> A subsequent unbind may therefore free the stale pointer again,
> resulting in a double-free.
> 
> Set f->os_desc_table to NULL after freeing it to prevent the stale
> pointer from being reused across bind/unbind cycles.
> 
> Fixes: de7a8d2d534f ("usb: gadget: f_rndis: OS descriptors support")
> Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109060018.71063-1-xinsheng.zhu.ny@gmail.com?part=1