From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2A3C32C302 for ; Fri, 13 Mar 2026 12:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773405662; cv=none; b=Iv015S0J3IlxKfRh7SP4j9WBPkoKmF5IsVLDeYvSjpa09G5dER2rAwDJ4LHz+oFmIbOTxXUrCVipO+dpJjfRHuzX57f/e3ymIxIXkuZW8weQeu1HqAgH4DOXwJzq34Yjkg+kPc4j7/BTKVHiaRAg+4Od3ptubPkIkG5RoJ42D78= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773405662; c=relaxed/simple; bh=vMlORAt4cIj9y6zXy3C5Rkdql4j2VAXzC+gB7tFbydI=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=QrxO+kCyc6jUv1NY2GK8pXxhmxwSXJFxFiMETlDDqHdAF/wuPnD4q3BD7nLkBMuOAebxMZN6HqeGaJeYNxlSBVLDMRX6M30TTAWyokPxa//BLltjoTs33sJD9671eYKlty1C4+QsklTI4a5MRPngnVXtw+TvJRu88OxAyKP6TTA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=fairphone.com; spf=pass smtp.mailfrom=fairphone.com; dkim=pass (2048-bit key) header.d=fairphone.com header.i=@fairphone.com header.b=m5iCCBby; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=fairphone.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fairphone.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=fairphone.com header.i=@fairphone.com header.b="m5iCCBby" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-485392de558so13590285e9.1 for ; Fri, 13 Mar 2026 05:40:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fairphone.com; s=fair; t=1773405658; x=1774010458; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=nfn1fOOKJySp+MZNu6YVwSfAvLP9ZgswVIRNDlPFWRM=; b=m5iCCBbyYdIimFiJPmS7NHk431+doHWxY58zMOrLVhefnh4N9B9a1Zdm3acdP2vnwf YPlIKBoIcO6+HWrzD/LtEAqDOuhrfDn/jlah9rn4Tq0SmJMnJI7s+KiECeF8zUHr9kja WejOXkB5zpyt9+MPyPV5b/7jdV1aQxu7uguQqZguQhRN16C7naQTGxsmTl1c2GXCvTqI Sp3ndPgevdrbfyltVVY9wU0SB4nvOxkoOkWDgscEFhB22VFKe7Iszq7OhMi5dW0VH2cC /Ok21wrYC7NJbAYcUwwl4MUvyWM9zlvigxt03harLsxn9P/a3UrZxBnothNGgmuIW/c+ BhRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773405658; x=1774010458; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=nfn1fOOKJySp+MZNu6YVwSfAvLP9ZgswVIRNDlPFWRM=; b=bbiypbH/4ZRD14FflGC6ayc0DW3i2X8c5SIXDjJd1oEXYWyLAQTSmCICrMab7O4KIZ dGeCS2mykOFYUNfw2TrfOwOQKRZvf1qCetUsT4JSWQ4OvpLoSwH6dLUWYYEvvSlLmmED Yo/Oc0MVeZCE3AdGRB9Vk3XDUsUPUUESgwSxD61lP7j8BSS8WtJvwWKPEe1zXnBoGcpc sIpa3FlMCEyVMqpm9Dl5lDfKxhwoJetdrolbwAnbRUY+V0xWsdtjg9HPSEpvwYeGZjWl ZCepmVqv4695QbINKJRon9PY17Tm6fLbfEazuhIXpK3VBGcV9GTmz1KfesxJX4FEqH58 KOHA== X-Forwarded-Encrypted: i=1; AJvYcCVxinj60fDsUotnFF2JeVLYg+3IHX2zLv83H50omP2dIeYvPZmzDhtTnYt2rERELWlzYA7Axwj//lr8UKg=@vger.kernel.org X-Gm-Message-State: AOJu0YzRzvQmbUx/+skTrAJ6tHiBBgLVQBHHgcahSYZ6Hj8y5ixb9YTh 0N7HMmv+NnOfuK5xJO2JN6D4wFGbs51rUgM3OAQV5/DlzYtQcCaLRV4tZgPG3KY86lk= X-Gm-Gg: ATEYQzwPzbmScPJnNoAOToThfAogikbCpUyEtL7hYYls4ZRUoG+9tjalHe0XW4V/CSo BhQLjtcbdhRK8OFgh3aZzKPfIDCMAnS8dqnR47PgtA8KsKQ9x+1gOLhqIH68JcnY/t1FHOHs2SF 1YfXZ/AYdxURIiicCPAE27bkB3JNlHhz8+WwWJkUcqCJurDLKiqdqxbGnbSfJXCtUmxCLPBRH4a DSBYnvut7D7sJ5vlL2lTTXZQv1GKeXNCBKZgvjxDhr9HToTXBZDXtOOlDdV+EuPqOSxQ/J9SjvL SdjKSNKCJmVXAzQARbL3t3uxqHZARDpspQNiqwBHNJ5QJ7QdVPIYy7eKdPdltdH3pa37aUek+Uv mx5bfZwZKu1SpG3IC/dBCiHLG+sFotwAGv17Mei+J3Hk5Z8Tnp9DDcKbGrNlRO9hjhWHghsRBIE XVa6F4mhn65D2qVnU4zn0ZYnpYJAGl3PJND88Y1ZgX2uxjRx8U5b3QbXq3HV8DeQTA5RRk X-Received: by 2002:a05:600c:3545:b0:485:41c4:e2e4 with SMTP id 5b1f17b1804b1-4855670513bmr50876245e9.23.1773405657731; Fri, 13 Mar 2026 05:40:57 -0700 (PDT) Received: from localhost (144-178-202-138.static.ef-service.nl. [144.178.202.138]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-439fe2187aasm15314223f8f.30.2026.03.13.05.40.56 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 13 Mar 2026 05:40:57 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 13 Mar 2026 13:40:56 +0100 Message-Id: Cc: "David Heidelberg" , "Ernest Van Hoecke" , "Jon Hunter" , "LI Qingwu" , , , Subject: Re: [PATCH v2 0/7] usb: gadget: Fix net_device lifecycle with device_move From: "Luca Weiss" To: "Kuen-Han Tsai" , "Greg Kroah-Hartman" , "Felipe Balbi" , "Kyungmin Park" X-Mailer: aerc 0.21.0-0-g5549850facc2 References: <20260309-f-ncm-revert-v2-0-ea2afbc7d9b2@google.com> In-Reply-To: <20260309-f-ncm-revert-v2-0-ea2afbc7d9b2@google.com> Hi Kuen-Han, On Mon Mar 9, 2026 at 1:04 PM CET, Kuen-Han Tsai wrote: > PROBLEMS > -------- > The net_device in f_ncm is allocated at function instance creation > and registered at bind time with the gadget device as its sysfs parent. > When the gadget unbinds, the parent device is destroyed but the > net_device survives, leaving dangling sysfs symlinks and a NULL pointer > dereference when userspace accesses the orphaned interface: > > Problem 1: Unable to handle kernel NULL pointer dereference > Call trace: > __pi_strlen+0x14/0x150 > rtnl_fill_ifinfo+0x6b4/0x708 > rtmsg_ifinfo_build_skb+0xd8/0x13c > ... > netlink_sendmsg+0x2e0/0x3d4 > > Problem 2: Dangling sysfs symlinks > console:/ # ls -l /sys/class/net/ncm0 > lrwxrwxrwx ... /sys/class/net/ncm0 -> > /sys/devices/platform/.../gadget.0/net/ncm0 > console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0 > ls: .../gadget.0/net/ncm0: No such file or directory > > BACKGROUND & THE REVERTS > ------------------------ > The deferred allocation causes a regression for userspace tools during > network setup (such as the postmarketOS DHCP daemon). By moving the > allocation out of alloc_inst, configfs returns the name pattern "usb%d" > instead of the actual interface name (e.g., "usb0") when userspace reads > the 'ifname' attribute. > > Investigating a fix for this naming issue revealed a deeper > architectural flaw introduced by the series. Deferring the allocation to > bind() means that a single function instance will spawn multiple network > devices if it is symlinked to multiple USB configurations. > > Because all configurations tied to the same function instance are > architecturally designed to share a single network device, and configfs > only exposes a single 'ifname' attribute per instance, this 1-to-many > bug cannot be safely patched. > > To restore the correct 1:1 mapping and resolve the userspace > regressions, this series reverts the changes in reverse order, returning > the net_device allocation back to the instance level (alloc_inst). > > THE NEW SOLUTION > ---------------- > Use device_move() to reparent the net_device between the gadget device > tree and /sys/devices/virtual across bind/unbind cycles. On the last > unbind, device_move(NULL) moves the net_device to the virtual device > tree before the gadget device is destroyed. On rebind, device_move() > reparents it back under the new gadget, restoring proper sysfs topology > and power management ordering.=20 > > The 1:1 mapping between function instance and net_device is maintained, > and configfs always reports the resolved interface name. > > A bind_count tracks how many configurations reference the function > instance, ensuring device_move fires only on the first bind. > __free(detach_gadget) ensures the net_device is moved back to virtual > if bind fails after a successful device_move, preventing dangling > sysfs on partial bind failure. Applying this series on v7.0-rc3 fixes the reported issues for me on Qualcomm-based Fairphone (Gen. 6). For v7.0-rc3 the first two commits need to be skipped, looks like the original commits are only in -next and not in v7.0-rc? Tested-by: Luca Weiss # milos-fairphone-fp6 Thanks for fixing this! Regards Luca > > Reported-by: David Heidelberg > Link: https://lore.kernel.org/linux-usb/70b558ea-a12e-4170-9b8e-c95113124= 9af@ixit.cz/ > Signed-off-by: Kuen-Han Tsai > --- > Changes in v2: > - Introduce a new solution > - Link to v1: https://lore.kernel.org/r/20260304-f-ncm-revert-v1-0-57c915= 7b58af@google.com > > --- > Kuen-Han Tsai (7): > Revert "usb: gadget: f_ncm: Fix atomic context locking issue" > Revert "usb: legacy: ncm: Fix NPE in gncm_bind" > Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/un= bind" > Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing n= et_device" > Revert "usb: gadget: u_ether: use header file" > Revert "usb: gadget: u_ether: add gether_opts for config caching" > usb: gadget: f_ncm: Fix net_device lifecycle with device_move > > drivers/usb/gadget/function/f_ncm.c | 129 +++++++++++-------- > drivers/usb/gadget/function/u_ether.c | 67 ++++------ > drivers/usb/gadget/function/u_ether.h | 56 ++++----- > drivers/usb/gadget/function/u_ether_configfs.h | 168 -------------------= ------ > drivers/usb/gadget/function/u_ncm.h | 5 +- > drivers/usb/gadget/legacy/ncm.c | 13 +- > 6 files changed, 127 insertions(+), 311 deletions(-) > --- > base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589 > change-id: 20260304-f-ncm-revert-490a66ae8da0 > > Best regards,