USB: gadget: Fix UAF in gadgetfs_fill_super()

When gadgetfs_fill_super() fails, it's error path calls put_dev() which drops refcount inside the_device to 0 and frees the objet. But the_device pointer is not cleared, leading to point at freed memory.

VFS will then call gadgetfs_kill_sb() after mount
failure leading to put_dev() to be called on the
already freed pointer.

Fix by setting the_device = NULL during error path before calling put_dev() inside gadgetfs_fill_super() so that gadgetfs_kill_sb() skips put_dev().

---

Changes from v1:

Removed unecessary reference to syzkaller in the description.

Added Reviewed-by: tag.

 drivers/usb/gadget/legacy/inode.c | 1 +
 1 file changed, 1 insertion(+)

index d87a8ab51510..3e2bce7543d4 100644
@@ -2059,6 +2059,7 @@ gadgetfs_fill_super (struct super_block *sb, struct fs_context *fc)
 	rc = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
 	if (rc) {
 		put_dev(dev);
+		the_device = NULL;
 		goto Enomem;
 	}
 

2.43.0