Re: [syzbot] [usb?] WARNING in usbnet_status_start

[Hillf Danton <hdanton@sina.com>]

> Date: Tue, 08 Jul 2025 10:51:27 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d1b07cc0868f arm64: dts: s32g: Add USB device tree informa..
> git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
> console output: https://syzkaller.appspot.com/x/log.txt?x=1554d582580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=28729dff5d03ad1
> dashboard link: https://syzkaller.appspot.com/bug?extid=3f89ec3d1d0842e95d50
> compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11680a8c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14c9abd4580000

#syz test

--- x/drivers/net/usb/usbnet.c
+++ y/drivers/net/usb/usbnet.c
@@ -231,6 +231,8 @@ static int init_status (struct usbnet *d
 	if (!dev->driver_info->status)
 		return 0;
 
+	if (!dev->status)
+		return -EINVAL;
 	pipe = usb_rcvintpipe (dev->udev,
 			dev->status->desc.bEndpointAddress
 				& USB_ENDPOINT_NUMBER_MASK);
@@ -254,6 +256,8 @@ static int init_status (struct usbnet *d
 				"status ep%din, %d bytes period %d\n",
 				usb_pipeendpoint(pipe), maxp, period);
 		}
+	} else {
+		return -ENOMEM;
 	}
 	return 0;
 }
@@ -1812,7 +1816,7 @@ usbnet_probe (struct usb_interface *udev
 		if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
 			status = -EINVAL;
 	}
-	if (status >= 0 && dev->status)
+	if (status >= 0)
 		status = init_status (dev, udev);
 	if (status < 0)
 		goto out3;
--