[PATCH] usb: gadget: f_phonet: fix out-of-bounds read in ifname_show

[PATCH] usb: gadget: f_phonet: fix out-of-bounds read in ifname_show

[Alexander Bendezu]

The f_phonet_ifname_show() function incorrectly used gether_get_ifname(),
which casts the net_device private data to 'struct eth_dev'. Since the
Phonet gadget only allocates a small 'struct phonet_port' for its private
data, this resulted in a KASAN slab-out-of-bounds read when accessing
dev->ifname_set.

Fix this by safely reading the network device name directly using
netdev_name() and dropping the u_ether.h include, completely avoiding
the invalid struct cast.

Fixes: 0736390bea65 ("usb-gadget/f_phonet: use per-attribute show and store methods")
Reported-by: syzbot+3a0d6aa450317f25e501@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3a0d6aa450317f25e501
Signed-off-by: Alexander Bendezu <alexanderbendezu10@gmail.com>
---
 drivers/usb/gadget/function/f_phonet.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b1ee9a7c2e94..a17e74bcc07c 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/device.h>
 
+#include <linux/rtnetlink.h>
 #include <linux/netdevice.h>
 #include <linux/if_ether.h>
 #include <linux/if_phonet.h>
@@ -600,7 +601,13 @@ static const struct configfs_item_operations phonet_item_ops = {
 
 static ssize_t f_phonet_ifname_show(struct config_item *item, char *page)
 {
-	return gether_get_ifname(to_f_phonet_opts(item)->net, page, PAGE_SIZE);
+	struct net_device *net = to_f_phonet_opts(item)->net;
+	int ret;
+
+	rtnl_lock();
+	ret = scnprintf(page, PAGE_SIZE, "%s\n", netdev_name(net));
+	rtnl_unlock();
+	return ret;
 }
 
 CONFIGFS_ATTR_RO(f_phonet_, ifname);
-- 
2.53.0

Re: [PATCH] usb: gadget: f_phonet: fix out-of-bounds read in ifname_show

[Greg Kroah-Hartman]

On Sat, Aug 22, 2026 at 07:52:30AM +0000, Alexander Bendezu wrote:
> The f_phonet_ifname_show() function incorrectly used gether_get_ifname(),
> which casts the net_device private data to 'struct eth_dev'. Since the
> Phonet gadget only allocates a small 'struct phonet_port' for its private
> data, this resulted in a KASAN slab-out-of-bounds read when accessing
> dev->ifname_set.
> 
> Fix this by safely reading the network device name directly using
> netdev_name() and dropping the u_ether.h include, completely avoiding
> the invalid struct cast.
> 
> Fixes: 0736390bea65 ("usb-gadget/f_phonet: use per-attribute show and store methods")
> Reported-by: syzbot+3a0d6aa450317f25e501@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3a0d6aa450317f25e501
> Signed-off-by: Alexander Bendezu <alexanderbendezu10@gmail.com>
> ---
>  drivers/usb/gadget/function/f_phonet.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
> index b1ee9a7c2e94..a17e74bcc07c 100644
> --- a/drivers/usb/gadget/function/f_phonet.c
> +++ b/drivers/usb/gadget/function/f_phonet.c
> @@ -13,6 +13,7 @@
>  #include <linux/module.h>
>  #include <linux/device.h>
>  
> +#include <linux/rtnetlink.h>
>  #include <linux/netdevice.h>
>  #include <linux/if_ether.h>
>  #include <linux/if_phonet.h>
> @@ -600,7 +601,13 @@ static const struct configfs_item_operations phonet_item_ops = {
>  
>  static ssize_t f_phonet_ifname_show(struct config_item *item, char *page)
>  {
> -	return gether_get_ifname(to_f_phonet_opts(item)->net, page, PAGE_SIZE);

So this has never worked at all?  How has no one noticed this in the
past decade?

> +	struct net_device *net = to_f_phonet_opts(item)->net;
> +	int ret;
> +
> +	rtnl_lock();
> +	ret = scnprintf(page, PAGE_SIZE, "%s\n", netdev_name(net));

sysfs_emit() please.

And what is the lock really doing here?  Why would this configfs file be
here if there was not a netdev present?

thanks,

greg k-h