Re: [PATCH v3] usb: gadget: f_phonet: fix use-after-free in pn_bind

[Greg KH]

On Wed, Aug 05, 2026 at 12:13:19PM +0800, Nguyen Quang Le Kien wrote:
> pn_bind() and phonet_free_inst() race on opts->bound and opts->net.
> If configfs removes the function instance while pn_bind() is between
> the !bound check and setting bound = true, free_inst() frees opts->net
> and pn_bind() then writes to net->dev.parent via gphonet_set_gadget().
> 
> The old "no race condition" comment was wrong - configfs_rmdir() can
> run in parallel with the composite bind path.
> 
> Add a mutex to f_phonet_opts, use scoped_guard(mutex) in both paths,
> add kernel-doc on the struct, and destroy the mutex before freeing
> opts.
> 
> Fixes: 00a2430ff07d ("usb: gadget: Gadget directory cleanup - group usb functions")
> Reported-by: syzbot+098999e05b6b877c01b3@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=098999e05b6b877c01b3
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@xxxxxxxxx>
> ---
> v3: drop the redundant #include <linux/mutex.h> in f_phonet.c -
>     u_phonet.h already includes it.
> 
> v2: scoped_guard(mutex) instead of open-coded lock/unlock; kernel-doc
>     on the struct; mutex_destroy(); remove the wrong comment.

You did not use the Assisted-by: tag as you should have :(