Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[David Heidelberg <david@ixit.cz>]

On 02/03/2026 11:15, Kuen-Han Tsai wrote:
[...]>
> David, could you share exactly what OS you are using (e.g.,
> postmarketOS with an sdm845/6.18-dev tree)? Also, could you provide
> some instructions on how to build the code and reproduce this problem
> on a Pixel 3? If you have the time, it would be incredibly helpful if
> you could dive into this a bit deeper on your device to see exactly
> how the DHCP daemon is failing.

Hello Kuen-Han,

it's pmOS initrd, but generally I got reported same behaviour on Mobian (Mobile 
Debian) too.

The Pixel 3 support was merged, so it can be reproduced with:
1. 7.0-rc1 tag
2. -next tree (latest tested is next-20260227)
3. our sdm845-next tree [1] (some WIP patches, working touchscreen on Pixel 3, 
etc.), the tree currently contains the reverts

I can provide log with the patch [2], without the patch [3] (well, it's more 
like nothing is in the log)

I'm very lightly familiar with usb subsystem, so if you give me hints what to 
look for (or what to debug), I'll try find a moment to check to move this forward.

Thank you for working on improving usb gadgets!
David

[1] https://codeberg.org/sdm845/linux/
[2] https://paste.sr.ht/~okias/35982d7e284ee0f767e57923ced591beb4d3b238#L589
[3] https://paste.sr.ht/~okias/4e9172a34e4093445536b51e935dbd229edad7b2#L613


> 
> Regards,
> Kuen-Han
> 
> 
>>
>> On 21/02/2026 15:48, Kuen-Han Tsai wrote:
>>> Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
>>> with bind/unbind") addressed a lifetime mismatch where the network
>>> interface outlived the parent gadget. However, this introduced two
>>> regressions:
>>>
>>> 1. A NULL pointer dereference in the legacy g_ncm driver. The legacy
>>>      driver attempts to access the net_device during its binding process
>>>      before the NCM function driver is fully initialized.
>>>
>>> 2. A "sleeping function called from atomic context" error in f_ncm.
>>>      The current implementation holds a mutex which might sleep within
>>>      an atomic context.
>>>
>>> To resolve these, store the configuration parameters (qmult, host_addr,
>>> dev_addr) in opts_net until the network device is ready for g_ncm.
>>> Additionally, remove the net_device pointer from the f_ncm_opts
>>> structure. This eliminates the race condition with configfs and allows
>>> dropping the mutex, preventing the atomic sleep issue.
>>>
>>> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
>>> ---
>>> Changes in v2:
>>> - Remove the RFC tag.
>>> - Fix NPE in gncm reported by the kernel test bot.
>>> - Fix a "sleeping function called from atomic context" error.
>>> - Link to v1: https://lore.kernel.org/r/20260214-legacy-ncm-v1-1-139c5bcc6636@google.com
>>>
>>> ---
>>> Kuen-Han Tsai (2):
>>>         usb: legacy: ncm: Fix NPE in gncm_bind
>>>         usb: gadget: f_ncm: Fix atomic context locking issue
>>>
>>>    drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
>>>    drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
>>>    drivers/usb/gadget/function/u_ncm.h            |  1 -
>>>    drivers/usb/gadget/legacy/ncm.c                | 13 +++++++++---
>>>    4 files changed, 23 insertions(+), 31 deletions(-)
>>> ---
>>> base-commit: da87d45b195148d670ab995367d52aa9e8a9a1fa
>>> change-id: 20260214-legacy-ncm-8c001295b343
>>>
>>> Best regards,
>>
>> --
>> David Heidelberg
>>

-- 
David Heidelberg