usb: gadget: f_rndis: Protect RNDIS options with mutex

commit 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e upstream.

The class/subclass/protocol options are suspectible to race conditions
as they can be accessed concurrently through configfs.

Use existing mutex to protect these options. This issue was identified
during code inspection.

Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-2-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index ee95e8f5f9d489a58735d2394eca222509da8a17..dc820c9586a7bbb61d329b80f8f47a7a1fb9f708 100644 (file)
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -11,6 +11,7 @@
 
 /* #define VERBOSE_DEBUG */
 
+#include <linux/cleanup.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -690,9 +691,11 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                f->os_desc_table[0].os_desc = &rndis_opts->rndis_os_desc;
        }
 
+       mutex_lock(&rndis_opts->lock);
        rndis_iad_descriptor.bFunctionClass = rndis_opts->class;
        rndis_iad_descriptor.bFunctionSubClass = rndis_opts->subclass;
        rndis_iad_descriptor.bFunctionProtocol = rndis_opts->protocol;
+       mutex_unlock(&rndis_opts->lock);
 
        /*
         * in drivers/usb/gadget/configfs.c:configfs_composite_bind()