[PATCH] usb: gadget: f_phonet: fix out-of-bounds read in ifname_show

[Alexander Bendezu]

The f_phonet_ifname_show() function incorrectly used gether_get_ifname(),
which casts the net_device private data to 'struct eth_dev'. Since the
Phonet gadget only allocates a small 'struct phonet_port' for its private
data, this resulted in a KASAN slab-out-of-bounds read when accessing
dev->ifname_set.

Fix this by safely reading the network device name directly using
netdev_name() and dropping the u_ether.h include, completely avoiding
the invalid struct cast.

Fixes: 0736390bea65 ("usb-gadget/f_phonet: use per-attribute show and store methods")
Reported-by: syzbot+3a0d6aa450317f25e501@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=3a0d6aa450317f25e501
Signed-off-by: Alexander Bendezu <alexanderbendezu10@xxxxxxxxx>
---
 drivers/usb/gadget/function/f_phonet.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b1ee9a7c2e94..a17e74bcc07c 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/device.h>
 
+#include <linux/rtnetlink.h>
 #include <linux/netdevice.h>
 #include <linux/if_ether.h>
 #include <linux/if_phonet.h>
@@ -600,7 +601,13 @@ static const struct configfs_item_operations phonet_item_ops = {
 
 static ssize_t f_phonet_ifname_show(struct config_item *item, char *page)
 {
-	return gether_get_ifname(to_f_phonet_opts(item)->net, page, PAGE_SIZE);
+	struct net_device *net = to_f_phonet_opts(item)->net;
+	int ret;
+
+	rtnl_lock();
+	ret = scnprintf(page, PAGE_SIZE, "%s\n", netdev_name(net));
+	rtnl_unlock();
+	return ret;
 }
 
 CONFIGFS_ATTR_RO(f_phonet_, ifname);
-- 
2.53.0