From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5652A8462 for ; Tue, 26 May 2026 05:56:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779774981; cv=none; b=a3f4e00/Ap2zCmGxOn6fEH8RIgQUTnnfQmBuhmSufdmbAzyJlFJM1J+FB/d60/6C9KXDzWYT11bjQZIYvyb31xhlT8yTsifi/PZAZ/NTyaJst7eH3BnEE0oTmtEH9P3/fSukBUcjE7wPlQMw9fj0AqGqrKJcSezR8PUM1A9mCpg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779774981; c=relaxed/simple; bh=qQtbda1P/oGFIFnlbhP/vFGqkEuuQ0uC4OudUy+fFIM=; h=Message-ID:Date:MIME-Version:From:Subject:To:Cc:Content-Type; b=Bm5WdcLPZKaaNtEHnGROHGxLN6UBcxQOnO23bMb0ktpEIL+yJewGL59KY2dLmkWxcWVcheUavqF+RzXnu9gvsQpoCtqcFNBJlLod9fy5lprtCE8RMptsfV79lva/PbdzcgbbTXIhgDV/MNTyZnGYenju920qojBggUPEA/b9ItU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Os5GTe9w; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Os5GTe9w" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-452169ae568so6533666f8f.3 for ; Mon, 25 May 2026 22:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779774978; x=1780379778; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:from:content-language :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=/+tzxiMti/hkPabMXB5B0TCtwIofItPhM7EIuDr1tBY=; b=Os5GTe9w3OkO7J/qnEijfllW3a0oWXUC3d+MtwllgcYtb1iuymIRy9xnHZhCJ6Kwaj utQy4dGN75KkNlls2KCd6ZzMhZ9vXsNjVv4Okojd2HLqg4jHZjGLpvx79xgC9et2wjyo xSmosazW04zLMq/rXSh3fUUe9TqEdDHLgQa8vHyQl9YOC5xt6LUxcm/LpUYuaQnkgAjO r5qEj0WcAwEh9pnPmfwBLDcynvJ6Xhit78YV+QlD8AmE7Th+37QNlB93lmqiORBoFdcU AcvSFN6e0YOVGMlDj3weGNecZO9PRsue6/IqVYqW+kPlhbzP8Wh34LxfVSvjuNaMvNo9 Kj/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779774978; x=1780379778; h=content-transfer-encoding:cc:to:subject:from:content-language :user-agent:mime-version:date:message-id:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=/+tzxiMti/hkPabMXB5B0TCtwIofItPhM7EIuDr1tBY=; b=CG8dNRuJjkfRZClQk4gkDvJEv/xV+nS13Y+ZP4fVjFz6pTySXvBN8yLFj1NrO2PUyt zjCXGcaixUoo0OIBmKi0gmJAfzcuqq76uLNULG3oqKW711UBQM2vQ9EmSR4EIy5mPCX5 Ti/mBGZSUB7BEGs6f8lp8FLFu6EjshY3xIXaK+uyuy3i4tmReT+aWX1hsbNlbbuINXxU /c+duY18WZVItF9v7MSF8vXGY55HtxvWT50wGLYBfylbbpqU7Hy8+Cue3jf2aq2ftbC8 DtMzmzecIJuRsHpQbhWj84660FF+nnUDA/P5nYdVBRpGXFhbgEL9G/3LF+3HuWwkfBLZ cyBQ== X-Forwarded-Encrypted: i=1; AFNElJ8tw0RHVx97SSElW8jPxya+0z3iZUxg7Ff3y9bUVdxWGzHyUQimIQw5HiWkXP+1k1L3acRVoub7VM4YEIg=@vger.kernel.org X-Gm-Message-State: AOJu0YxAqtvlzObWc5y7UM38/f2nM8C+F8JSJswwueHa3Zjmo7mBL/lm LtfPGEkH3eyiPFzCpePoyqj92T+2i1eNr6EyY07ZNZ4jVTHwMaplqfe9 X-Gm-Gg: Acq92OFFlPnL5GKKKCn2WLXcck053Wf5R/Ly9DPJT+6972wouErZSGogox0wBO4AXsq ESXXEUdCQNugBUiO8PTXTfUg9Pb/40cOT/docL2uwDS7QsP86ztW2H8oqGVsSQ9DWZSs4vEwBia I9Mt/hyZnxPxeYGbU4rgpyxFhbcg10lnpEL9qY9URC7aUU/74nBJ0CrwvdvzxCoAb74oeZc1rfl FiXBwcfgxXKI1qIBDq0RKVM2dBNkB+ZRgFOeZATom1fi9SzGjmajPUBd8fVZ0QYX+Iem6w4LmqU I90TpPEKt1ot5147ySSJblCqUJa1XVTHs9YuzgcL+5vhExK3feW4mHELIdMD6pVbG+rvnGSHQJC 4VJocQ9HdZJfk35ANY+Cjty4fTAbBEwupsH5HOWO2N4kdQWqrJNJRHRHCKskrelfoc03rf6+SrZ 5qTayjGQyg6oavcro/VFvL5CBleD8gVaH8mp754FdPnfl/2g== X-Received: by 2002:a05:6000:1446:b0:43d:7a97:78af with SMTP id ffacd0b85a97d-45eb38e04e3mr29609480f8f.42.1779774977394; Mon, 25 May 2026 22:56:17 -0700 (PDT) Received: from [192.168.1.10] ([95.43.220.235]) by smtp.googlemail.com with ESMTPSA id ffacd0b85a97d-45eb6cce01asm33665917f8f.11.2026.05.25.22.56.16 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 25 May 2026 22:56:17 -0700 (PDT) Message-ID: <89e19e6e-7ee7-4bb0-abd6-60971b7fd601@gmail.com> Date: Tue, 26 May 2026 08:56:15 +0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-GB From: Ivaylo Dimitrov Subject: [REGRESSION] usb: gadget: u_ether NULL deref in eth_stop after gether_detach_gadget To: Greg Kroah-Hartman , khtsai@google.com Cc: sashal@kernel.org, Merlijn Wajer , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit on linux 6.18.31 I am seeing a NULL pointer dereference during RNDIS gadget teardown. [ 7207.040679] udc musb-hdrc.2.auto: unbinding gadget driver [g1] [ 7207.041442] configfs-gadget.g1 gadget.0: unbind function 'rndis'/c807d802 [ 7207.044097] rndis_deregister: [ 7207.050445] 8<--- cut here --- [ 7207.050445] Unable to handle kernel NULL pointer dereference at virtual address 00000080 when read [ 7207.050628] [00000080] *pgd=00000000 [ 7207.050659] Internal error: Oops: 5 [#1] SMP ARM [ 7207.050659] Modules linked in: phy_cpcap_usb aes_arm_bs aes_arm aes_generic ccm bnep usb_f_rndis u_ether usb_f_mass_storage libcomposite bluetooth ecdh_generic ecc zram zsmalloc nf_tables nfnetlink snd_soc_audio_graph_card option qmi_wwan gnss_motmdm usb_wwan gnss snd_soc_motmdm cdc_wdm usbnet usbserial snd_soc_omap_hdmi wl12xx wlcore mac80211 libarc4 cfg80211 panel_dsi_cm joydev mousedev evdev omapdrm drm_display_helper snd_soc_audio_graph_card2 phy_mapphone_mdm6600 pwm_vibra snd_soc_simple_card_utils cec pvrsrvkm_omap4_sgx540_120 phy_generic ff_memless drm_client_lib pwm_omap_dmtimer omap_aes_driver emif libaes omap4_keypad omap_sham ohci_platform matrix_keymap ohci_hcd omap_mailbox omap2430 ehci_hcd st_accel_spi st_sensors_spi st_accel_i2c st_sensors_i2c wlcore_sdio st_accel musb_hdrc st_sensors ak8975 industrialio_triggered_buffer kfifo_buf udc_core usbcore usb_common w1_ds250x cpcap_battery cpcap_adc rtc_cpcap cpcap_charger omap_hdq wire snd_soc_omap_mcbsp snd_soc_cpcap cn phy_omap_usb2 serdev_ngsm isl29028 [ 7207.051177] cpcap_pwrbutton snd_soc_ti_sdma atmel_mxt_ts omap_des n_gsm lm75 industrialio libdes snd_soc_core omap_crypto crypto_engine hwmon leds_lm3532 snd_pcm_dmaengine display_connector snd_pcm drm_kms_helper snd_timer snd drm soundcore led_bl drm_panel_orientation_quirks touchscreen_buttons leds_cpcap gpio_keys led_class [last unloaded: phy_cpcap_usb] [ 7207.051361] CPU: 0 UID: 0 PID: 6109 Comm: hildon-usb-gadg Tainted: G W 6.18.31 #8 PREEMPT [ 7207.051391] Tainted: [W]=WARN [ 7207.051391] Hardware name: Generic OMAP4 (Flattened Device Tree) [ 7207.051391] PC is at dev_driver_string+0x0/0x38 [ 7207.051422] LR is at __dynamic_dev_dbg+0x8c/0x118 [ 7207.051422] pc : [] lr : [] psr: 40010113 [ 7207.051483] sp : f6265cc8 ip : f6265d64 fp : c1445150 [ 7207.051483] r10: 00002fef r9 : f6265e48 r8 : 00000000 [ 7207.051483] r7 : bf7e2000 r6 : 00000000 r5 : f6265ce4 r4 : 00000048 [ 7207.051513] r3 : 00000001 r2 : fffffffc r1 : 00000000 r0 : 00000048 [ 7207.051513] Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 7207.051544] Control: 10c5387d Table: 9a8b804a DAC: 00000051 [ 7207.051544] Register r0 information: non-paged memory [ 7207.051544] Register r1 information: NULL pointer [ 7207.051574] Register r2 information: non-paged memory [ 7207.051574] Register r3 information: non-paged memory [ 7207.051605] Register r4 information: non-paged memory [ 7207.051605] Register r5 information: 2-page vmalloc region starting at 0xf6264000 allocated at kernel_clone+0xa4/0x3d4 [ 7207.051635] Register r6 information: NULL pointer [ 7207.051666] Register r7 information: 1-page vmalloc region starting at 0xbf7e2000 allocated at load_module+0x800/0x208c [ 7207.051696] Register r8 information: NULL pointer [ 7207.051696] Register r9 information: 2-page vmalloc region starting at 0xf6264000 allocated at kernel_clone+0xa4/0x3d4 [ 7207.051727] Register r10 information: non-paged memory [ 7207.051727] Register r11 information: non-slab/vmalloc memory [ 7207.051757] Register r12 information: 2-page vmalloc region starting at 0xf6264000 allocated at kernel_clone+0xa4/0x3d4 [ 7207.051788] Process hildon-usb-gadg (pid: 6109, stack limit = 0xeff2ce29) [ 7207.051788] Stack: (0xf6265cc8 to 0xf6266000) [ 7207.051818] 5cc0: c0e03a1c 00000000 00000002 cef5af25 f6265d7c bf7e443c [ 7207.051818] 5ce0: f6265cd8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 7207.051818] 5d00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 7207.051849] 5d20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 7207.051849] 5d40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 7207.051879] 5d60: 00000000 cef5af25 f6265d38 c6248000 f6265e48 bf7e050c bf7e443c 000000e2 [ 7207.051879] 5d80: 0000003b 00000000 00000000 f6265d38 c6248000 f6265e48 00000000 bf7e4508 [ 7207.051879] 5da0: 00000000 f6265e48 00002fef c0b29a10 00000000 0000068e 00023864 c6248000 [ 7207.051910] 5dc0: 00000000 cef5af25 f6265d38 f6265d38 f6265e48 00000001 00000000 c0b29bb0 [ 7207.051910] 5de0: f6265e80 c03959cc 0b3dc968 00000000 00000000 cef5af25 f6265e40 f6265d38 [ 7207.051940] 5e00: f6265d38 f6265e94 f6265e48 00000000 f6265e48 c0b349c0 0b3dc968 00000000 [ 7207.051940] 5e20: c50f3040 60010013 6a14845e 00000000 0b3dc968 00000000 00000000 c50f4820 [ 7207.051940] 5e40: c50f3040 c03959cc c6248110 c6248110 c2ee9060 f6265e80 c50f3040 cef5af25 [ 7207.051971] 5e60: c2ee9000 c6248000 00000000 00000000 00000000 00000000 c411e050 bf7b507c [ 7207.051971] 5e80: 00000000 c0b351dc 0b3dc968 00000000 6a14845e c6248108 c6248108 cef5af25 [ 7207.052001] 5ea0: c6248000 c6248000 bf7c1160 c0b35a1c c6248640 bf7df5bc c3649e00 bf7ba068 [ 7207.052001] 5ec0: bf7be6c0 bf7b0350 c3649e00 c042cc34 00000040 c3649e00 bf7be6c0 c2ee9000 [ 7207.052001] 5ee0: 00000000 c042ab98 c50f3040 bf7b56c0 00000000 cef5af25 00000000 c2ee9000 [ 7207.052032] 5f00: 00000000 c50f4820 ffffff9c 00000000 00000002 c5fa53d0 c2e507f8 c0381e8c [ 7207.052032] 5f20: c2e507f8 f6265f68 00000000 c03808fc 00000000 c2ee9000 00000000 c2170000 [ 7207.052062] 5f40: ffffff9c c03877dc f6265f68 f6265f5c 00000000 00000ff0 c5fa53d0 00000000 [ 7207.052062] 5f60: c5fa53d0 c2e507f8 e7d70be1 0000000a c217003b 00000000 004c3efc cef5af25 [ 7207.052062] 5f80: beff9a3c beff9a3c 004c5488 004c5220 00000028 c01002ec c66a9f80 00000028 [ 7207.052093] 5fa0: 004c3efc c0100080 beff9a3c 004c5488 beff9a3c b6f046e5 00000000 00000000 [ 7207.052093] 5fc0: beff9a3c 004c5488 004c5220 00000028 00000001 004c52a0 00000000 004c3efc [ 7207.052124] 5fe0: b6f0708c beff9a24 b6f0071d b6e87ae8 80010030 beff9a3c 00000000 00000000 [ 7207.052124] Call trace: [ 7207.052124] dev_driver_string from __dynamic_dev_dbg+0x8c/0x118 [ 7207.052124] __dynamic_dev_dbg from eth_stop+0x70/0x134 [u_ether] [ 7207.052185] eth_stop [u_ether] from __dev_close_many+0xd0/0x1f4 [ 7207.052185] __dev_close_many from netif_close_many+0x7c/0x124 [ 7207.052337] netif_close_many from unregister_netdevice_many_notify+0x220/0x994 [ 7207.052337] unregister_netdevice_many_notify from unregister_netdevice_queue+0x9c/0xec [ 7207.052398] unregister_netdevice_queue from unregister_netdev+0x18/0x2c [ 7207.052398] unregister_netdev from gether_cleanup+0x14/0x28 [u_ether] [ 7207.052398] gether_cleanup [u_ether] from rndis_free_inst+0x2c/0x48 [usb_f_rndis] [ 7207.052459] rndis_free_inst [usb_f_rndis] from usb_put_function_instance+0x1c/0x28 [libcomposite] [ 7207.052459] usb_put_function_instance [libcomposite] from config_item_cleanup+0x64/0xa4 [ 7207.052612] config_item_cleanup from configfs_rmdir+0x1e8/0x300 [ 7207.052612] configfs_rmdir from vfs_rmdir+0x90/0x1ec [ 7207.052642] vfs_rmdir from do_rmdir+0x12c/0x170 [ 7207.052673] do_rmdir from ret_fast_syscall+0x0/0x58 [ 7207.052673] Exception stack(0xf6265fa8 to 0xf6265ff0) [ 7207.052703] 5fa0: beff9a3c 004c5488 beff9a3c b6f046e5 00000000 00000000 [ 7207.052703] 5fc0: beff9a3c 004c5488 004c5220 00000028 00000001 004c52a0 00000000 004c3efc [ 7207.052734] 5fe0: b6f0708c beff9a24 b6f0071d b6e87ae8 [ 7207.052734] Code: e3a02009 eae09cdf 00000477 c104c684 (e5903038) [ 7207.052764] ---[ end trace 0000000000000000 ]--- I suspect the reason is commit: usb: gadget: f_ncm: Fix net_device lifecycle with device_move The crash appears caused by DBG() inside eth_stop() dereferencing dev->gadget after gether_detach_gadget() has already executed: void gether_detach_gadget(struct net_device *net) { ... dev->gadget = NULL; } eth_stop() still executes afterwards during unregister_netdev() triggered from gether_cleanup()/rndis_free_inst(). The likely problematic path is: DBG(dev, ...) -> dev_dbg(&dev->gadget->dev, ...) which becomes invalid pointer dereference as dev->gadget is set to NULL already: This seems to be a regression caused by the new decoupled netdev/gadget lifetime semantics introduced by the patch. Previously dev->gadget appeared to remain valid for the entire netdev lifetime. The issue reproduces on ARM/OMAP4 during configfs RNDIS teardown. Regards, Ivaylo Dimitrov