Re: [PATCH v2] usb: gadget: f_phonet: fix use-after-free in pn_bind

On Tue, Aug 04, 2026 at 03:44:32PM +0800, Nguyen Quang Le Kien wrote:
> pn_bind() and phonet_free_inst() race on opts->bound and opts->net.
> If configfs removes the function instance while pn_bind() is between
> the !bound check and setting bound = true, free_inst() frees opts->net
> and pn_bind() then writes to net->dev.parent via gphonet_set_gadget().
> 
> The existing "no race condition" comment was wrong: configfs_rmdir()
> can run independently of the composite bind sequence.
> 
> Add a mutex to f_phonet_opts and use scoped_guard(mutex) in both
> pn_bind() and phonet_free_inst() to serialize access to ->bound and
> ->net. Add a kernel-doc comment describing what the lock protects,
> and destroy the mutex before freeing opts.
> 
> Fixes: 00a2430ff07d ("usb: gadget: Gadget directory cleanup - group usb functions")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=098999e05b6b877c01b3

Did this new version properly run through syzbot and it reported it
succeeded?



> Signed-off-by: Nguyen Quang Le Kien <[email protected]>
> ---
> v2:
>  - use scoped_guard(mutex) instead of open-coded lock/unlock
>  - add kernel-doc comment on struct f_phonet_opts describing what
>    @lock protects
>  - add explicit #include <linux/mutex.h>
>  - call mutex_destroy() before kfree(opts)
>  - remove stale "no race condition" comment; explain why it was wrong
>    in the commit message
> ---
>  drivers/usb/gadget/function/f_phonet.c | 34 +++++++++++++-------------
>  drivers/usb/gadget/function/u_phonet.h | 10 ++++++++
>  2 files changed, 27 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
> index b1ee9a7c2..350579747 100644
> --- a/drivers/usb/gadget/function/f_phonet.c
> +++ b/drivers/usb/gadget/function/f_phonet.c
> @@ -12,6 +12,7 @@
>  #include <linux/kernel.h>
>  #include <linux/module.h>
>  #include <linux/device.h>
> +#include <linux/mutex.h>

This isn't needed as you added it to the .h file, right?

And you didn't answer my question about LLM use.

thanks,

greg k-h