Re: [PATCH usb-next v2] usb: gadget: f_ncm: prevent double-free of OS descriptor table

[sashiko-bot@kernel.org]

> ncm_bind() allocates an OS descriptor table only when
> cdev->use_os_string is enabled. However, ncm_unbind() frees the
> table and resets f->os_desc_n without clearing f->os_desc_table,
> leaving a dangling pointer.
> 
> When a ConfigFS gadget is unbound, the function object can be reused
> for a subsequent bind. The OS descriptor support can be toggled
> through the ConfigFS os_desc/use attribute, which determines
> cdev->use_os_string on the next bind. If this flag changes from true
> to false between binds, ncm_bind() skips the allocation and leaves
> f->os_desc_table pointing to the previously freed memory.
> 
> A subsequent unbind may therefore free the stale pointer again,
> resulting in a double-free.
> 
> Set f->os_desc_table to NULL after freeing it to prevent the stale
> pointer from being reused across bind/unbind cycles.
> 
> Fixes: 793409292382 ("usb: gadget: f_ncm: Add OS descriptor support")
> Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109061110.80422-1-xinsheng.zhu.ny@gmail.com?part=1