Technical Summary

The Linux kernel's phonet socket implementation contained a vulnerability where pn_socket_autobind() called pn_socket_bind() with port 0 and, upon receiving an -EINVAL error, assumed the socket was already bound and asserted that the port was non-zero via BUG_ON(). However, pn_socket_bind() can return -EINVAL if the socket state is not TCP_CLOSE even if the socket was never bound and the port is zero. This causes the BUG_ON() to fire, resulting in a kernel panic from a user-triggerable path. The fix changes the code to treat the case where bind returns -EINVAL but the port is still zero as a normal error, propagating -EINVAL instead of crashing the kernel. Callers already handle non-zero returns by converting them to -ENOBUFS or -EAGAIN, so this fix prevents kernel panics without changing normal error handling.