Re: [PATCH] usb: gadget: f_ncm: Fix use-after-free in ncm_wrap_ntb()

[Boyan Liu <yymhvert@gmail.com>]

Hi,

Both findings are real bugs, but both predate this patch; the
use-after-free fix itself is unaffected.

[High] ncm->netdev NULL dereference in the err: path: agreed, the
window exists -- ncm_disable() clears ncm->netdev locklessly, and
ncm_tx_timeout() already treats it as possibly NULL (READ_ONCE +
check). It additionally needs an alloc_skb() failure inside that
window, so the race is narrow. Pre-existing; a fix (guard the stats
update in the err: path, or move the clear after
gether_disconnect()) can be sent separately and does not block this
patch.

[Medium] skb2 leak in the err: path: agreed, also pre-existing.
Since this patch already rewrites that block, I can fold

	if (skb2)
		dev_kfree_skb_any(skb2);

into a v2, or it can go as a separate follow-up -- whichever Greg
prefers.

Thanks,
Boyan