[PATCH] usb: gadget: f_ecm: Fix ecm_opts->bound logic in bind path

[PATCH] usb: gadget: f_ecm: Fix ecm_opts->bound logic in bind path

[Kuen-Han Tsai]

The bound flag in ecm_opts is being set to true even if
gether_register_netdev() failed.

Set ecm_opts->bound to true only upon success.

Fixes: d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in ecm_bind()")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
 drivers/usb/gadget/function/f_ecm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
index 027226325039..9f5ed6f32a62 100644
--- a/drivers/usb/gadget/function/f_ecm.c
+++ b/drivers/usb/gadget/function/f_ecm.c
@@ -690,13 +690,14 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
 
 	if (!ecm_opts->bound) {
 		status = gether_register_netdev(ecm_opts->net);
-		ecm_opts->bound = true;
 	}
 
 	mutex_unlock(&ecm_opts->lock);
 	if (status)
 		return status;
 
+	ecm_opts->bound = true;
+
 	ecm_string_defs[1].s = ecm->ethaddr;
 
 	us = usb_gstrings_attach(cdev, ecm_strings,
-- 
2.51.0.338.gd7d06c2dae-goog

Re: [PATCH] usb: gadget: f_ecm: Fix ecm_opts->bound logic in bind path

[Krzysztof Kozlowski]

On 03/09/2025 10:30, Kuen-Han Tsai wrote:
> The bound flag in ecm_opts is being set to true even if
> gether_register_netdev() failed.
> 
> Set ecm_opts->bound to true only upon success.
> 
> Fixes: d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in ecm_bind()")
> Cc: stable@kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
>  drivers/usb/gadget/function/f_ecm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
> index 027226325039..9f5ed6f32a62 100644
> --- a/drivers/usb/gadget/function/f_ecm.c
> +++ b/drivers/usb/gadget/function/f_ecm.c
> @@ -690,13 +690,14 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
>  
>  	if (!ecm_opts->bound) {
>  		status = gether_register_netdev(ecm_opts->net);
> -		ecm_opts->bound = true;
>  	}
>  
>  	mutex_unlock(&ecm_opts->lock);
>  	if (status)
>  		return status;
>  
> +	ecm_opts->bound = true;

Now it is outside of mutex, so this is raising questions you should have
answered in commit msg.

Best regards,
Krzysztof

Re: [PATCH] usb: gadget: f_ecm: Fix ecm_opts->bound logic in bind path

[Kuen-Han Tsai]

Hi Krzysztof,

On Wed, Sep 3, 2025 at 4:33 PM Krzysztof Kozlowski
<krzysztof.kozlowski@linaro.org> wrote:
>
> On 03/09/2025 10:30, Kuen-Han Tsai wrote:
> > The bound flag in ecm_opts is being set to true even if
> > gether_register_netdev() failed.
> >
> > Set ecm_opts->bound to true only upon success.
> >
> > Fixes: d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in ecm_bind()")
> > Cc: stable@kernel.org
> > Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> > ---
> >  drivers/usb/gadget/function/f_ecm.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
> > index 027226325039..9f5ed6f32a62 100644
> > --- a/drivers/usb/gadget/function/f_ecm.c
> > +++ b/drivers/usb/gadget/function/f_ecm.c
> > @@ -690,13 +690,14 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
> >
> >       if (!ecm_opts->bound) {
> >               status = gether_register_netdev(ecm_opts->net);
> > -             ecm_opts->bound = true;
> >       }
> >
> >       mutex_unlock(&ecm_opts->lock);
> >       if (status)
> >               return status;
> >
> > +     ecm_opts->bound = true;
>
> Now it is outside of mutex, so this is raising questions you should have
> answered in commit msg.
>

Thanks for the review.

1. Commit da92801c647c ("usb: gadget: f_ecm: add configfs support")
introduced a mutex_lock in the ecm_bind function, but this lock did
not protect the ecm_opts->bound flag. Subsequently, commit
d65e6b6e884a ("usb: gadget: f_ecm: Always set current gadget in
ecm_bind()") moved the status check outside the locked section but
neglected to also move the assignment for ecm_opts->bound.
2. The caller, configfs_composite_bind(), binds functions
sequentially, which prevents race conditions when accessing
ecm_opts->bound.

I will update the commit message and submit a new version shortly.

Regards,
Kuen-Han