From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEFBD3A7843 for ; Mon, 9 Mar 2026 12:05:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773057919; cv=none; b=GftPjvuh/2ypz1OXshzQAB6BQqtozrTjBZR+9k9qpZGc8erPHmMO0W2JewdInuxR4SGq5P2hYjemMXQG0QQr7WgPEweYN6UWyAJdH7W/OzIyNbQeP/vqS4nMJ12rrCO9/5oF5M5c6FlcxggJf/xR0Bn8Wu4cAfvwuPDJIzh+RSA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773057919; c=relaxed/simple; bh=RVsYDsCZmC3FgVru9fjR8o33BuHu9fkICkZ74ZUJ1hk=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=YgW6Kwfqq2kcO27KQsDXp0F7n1uxjI1cKMgGYho8HSn9yloPI228GuQadeiinPjTtZqrdZ0+fX4jsOIMwzlUp0VfMkqCAsTdQCcFAbrzRER8R8sMggNMk0e8bQFHoS2JX6bsiXT0+cLR955xdGO0WXsUe2SHPckFYZ626lnuw/s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=0Lpm0BGQ; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="0Lpm0BGQ" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2ae3f446ccfso83340765ad.2 for ; Mon, 09 Mar 2026 05:05:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1773057916; x=1773662716; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=ZW58/Pl2Sq+I7sc4XO4eZyZGX+Qi5iOeGztEkVLEFQ8=; b=0Lpm0BGQJhbc/Y/8PbANZeJ7Cdy12GPSarD7vN4V3PNI9aF/uLfAoSBRe9CnJwveAy dtt8RYHoJLWrvLMfGR3pfQQ7O3p3wWGw/ONpyjreEFayoDWm20Hr/73zyA6MmDQkD03Y Fsn8xHbEAJMOQLluexQJ/OpZheBRBmtT1VvWDWhnGAhnY4BvARXzlNo36dXhaJhAhC+m 3Aft8dPGPZQqlC9mC9YXElzA+4MLluim4RUuEKfhAb91xNQSc7FJDdWH1JE1Q4eg4B3Y Ugj/WXV2q3bkZu88URi437v6QkYmvLGHiO+85/3z9oUry6svqOz8Q+wcF3Ji62ssUIdP b2dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773057916; x=1773662716; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=ZW58/Pl2Sq+I7sc4XO4eZyZGX+Qi5iOeGztEkVLEFQ8=; b=CrEYQX6Gt95wh5BzcNsXeJzRupG7avcyk8R5JTmwP3v5Upi3RqF5Zv5ej94EgXjUKl jDZVmM1XNP/i/jkzBik54nccM1LtSh/VOpySJk733/6LksLexq+EjALWcmnewF8QCUu1 4TByUjcb1CkpWmXvdal8FzZTX/heYq5N+/9IIKTaUFyAdLll72vKQ2IhbHfT6DUZPGP3 YUX0bV4gw2+61tQm7Zo6RThI7qK7nB9vo/op/1k3w/50WrT1sg6xWNdWUJsp4sSUmiOm yv1oVrNuf6+q+aaPe4hb3xKUr5dz+8KCt/k5xj7S7l0WZq//zlUjVx/MQid/eMLqT8Xd wDtA== X-Forwarded-Encrypted: i=1; AJvYcCXvZFsrzTAibFncQMGCzFEUu5glNP5Q2mni3hDsJBdv/Nyrs1GDqLKWmF47Mx97gQ3rsLtpcu84ytdl5Tk=@vger.kernel.org X-Gm-Message-State: AOJu0YybNZHBK8JoMG2PtmAaCMVkfDUmk6Gb+RxUJwtaBI/ozOnHa0I3 SfvgCqzOyCwr4F31uaw2YiuO7PdOsNZEWDvvBtPBCtGcME0exY+JpUkr8fPu/r4l+4O+rQV8inl x6MXZkg== X-Received: from pliy14.prod.google.com ([2002:a17:903:3d0e:b0:2ae:42de:7ed4]) (user=khtsai job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:ac5:b0:2ae:4a6b:68ea with SMTP id d9443c01a7336-2ae82466961mr99050085ad.43.1773057915984; Mon, 09 Mar 2026 05:05:15 -0700 (PDT) Date: Mon, 09 Mar 2026 20:04:45 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAF23rmkC/3WMwQ7CIBAFf6XZs2sAC209+R+mB6QLJbHFQEM0D f8u9u5xXt7MDomipwTXZodI2Scf1gri1ICZ9eoI/VQZBBOKXViLFlezYL1S3LAdmFZKUz9pBlV 5RbL+feTuY+XZpy3Ez1HP/Lf+CWWODGVnBi67h+y1vbkQ3JPOJiwwllK+M7Ups6kAAAA= X-Change-Id: 20260304-f-ncm-revert-490a66ae8da0 X-Developer-Key: i=khtsai@google.com; a=ed25519; pk=abA4Pw6dY2ZufSbSXW9mtp7xiv1AVPtgRhCFWJSEqLE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1773057914; l=4284; i=khtsai@google.com; s=20250916; h=from:subject:message-id; bh=RVsYDsCZmC3FgVru9fjR8o33BuHu9fkICkZ74ZUJ1hk=; b=Z0a4qOLpsoE6BP4lXxCy7rvOj/FCf0KmRb7qOJ0mBUnenfQkLs2VvcV9fFcQpozWG3TiQAEvK d/aDEm7/eRICnEzeW5xeXNHxhduk3ExMDRrGpb1WRoS+npscf9nfcg0 X-Mailer: b4 0.14.3 Message-ID: <20260309-f-ncm-revert-v2-0-ea2afbc7d9b2@google.com> Subject: [PATCH v2 0/7] usb: gadget: Fix net_device lifecycle with device_move From: Kuen-Han Tsai To: Greg Kroah-Hartman , Felipe Balbi , Kyungmin Park Cc: David Heidelberg , Ernest Van Hoecke , Jon Hunter , LI Qingwu , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Kuen-Han Tsai , stable@kernel.org Content-Type: text/plain; charset="utf-8" PROBLEMS -------- The net_device in f_ncm is allocated at function instance creation and registered at bind time with the gadget device as its sysfs parent. When the gadget unbinds, the parent device is destroyed but the net_device survives, leaving dangling sysfs symlinks and a NULL pointer dereference when userspace accesses the orphaned interface: Problem 1: Unable to handle kernel NULL pointer dereference Call trace: __pi_strlen+0x14/0x150 rtnl_fill_ifinfo+0x6b4/0x708 rtmsg_ifinfo_build_skb+0xd8/0x13c ... netlink_sendmsg+0x2e0/0x3d4 Problem 2: Dangling sysfs symlinks console:/ # ls -l /sys/class/net/ncm0 lrwxrwxrwx ... /sys/class/net/ncm0 -> /sys/devices/platform/.../gadget.0/net/ncm0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0 ls: .../gadget.0/net/ncm0: No such file or directory BACKGROUND & THE REVERTS ------------------------ The deferred allocation causes a regression for userspace tools during network setup (such as the postmarketOS DHCP daemon). By moving the allocation out of alloc_inst, configfs returns the name pattern "usb%d" instead of the actual interface name (e.g., "usb0") when userspace reads the 'ifname' attribute. Investigating a fix for this naming issue revealed a deeper architectural flaw introduced by the series. Deferring the allocation to bind() means that a single function instance will spawn multiple network devices if it is symlinked to multiple USB configurations. Because all configurations tied to the same function instance are architecturally designed to share a single network device, and configfs only exposes a single 'ifname' attribute per instance, this 1-to-many bug cannot be safely patched. To restore the correct 1:1 mapping and resolve the userspace regressions, this series reverts the changes in reverse order, returning the net_device allocation back to the instance level (alloc_inst). THE NEW SOLUTION ---------------- Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind/unbind cycles. On the last unbind, device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebind, device_move() reparents it back under the new gadget, restoring proper sysfs topology and power management ordering. The 1:1 mapping between function instance and net_device is maintained, and configfs always reports the resolved interface name. A bind_count tracks how many configurations reference the function instance, ensuring device_move fires only on the first bind. __free(detach_gadget) ensures the net_device is moved back to virtual if bind fails after a successful device_move, preventing dangling sysfs on partial bind failure. Reported-by: David Heidelberg Link: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c951131249af@ixit.cz/ Signed-off-by: Kuen-Han Tsai --- Changes in v2: - Introduce a new solution - Link to v1: https://lore.kernel.org/r/20260304-f-ncm-revert-v1-0-57c9157b58af@google.com --- Kuen-Han Tsai (7): Revert "usb: gadget: f_ncm: Fix atomic context locking issue" Revert "usb: legacy: ncm: Fix NPE in gncm_bind" Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind" Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device" Revert "usb: gadget: u_ether: use header file" Revert "usb: gadget: u_ether: add gether_opts for config caching" usb: gadget: f_ncm: Fix net_device lifecycle with device_move drivers/usb/gadget/function/f_ncm.c | 129 +++++++++++-------- drivers/usb/gadget/function/u_ether.c | 67 ++++------ drivers/usb/gadget/function/u_ether.h | 56 ++++----- drivers/usb/gadget/function/u_ether_configfs.h | 168 ------------------------- drivers/usb/gadget/function/u_ncm.h | 5 +- drivers/usb/gadget/legacy/ncm.c | 13 +- 6 files changed, 127 insertions(+), 311 deletions(-) --- base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589 change-id: 20260304-f-ncm-revert-490a66ae8da0 Best regards, -- Kuen-Han Tsai