kernel/linux.git/drivers/usb/gadget/function/u_ether.c, branch v6.6.150

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

2026-06-19T11:39:28+00:00

[ Upstream commit e002e92e88e12457373ed096b18716d97e7bbb20 ] Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings. Suggested-by: Val Packett Reported-by: Val Packett Closes: https://lore.kernel.org/linux-usb/10890524-cf83-4a71-b879-93e2b2cc1fcc@packett.cool/ Fixes: ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260316-eth-null-deref-v1-1-07005f33be85@google.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Carlos Llamas Signed-off-by: Sasha Levin

usb: gadget: f_ncm: Fix net_device lifecycle with device_move

2026-06-19T11:39:28+00:00

[ Upstream commit ec35c1969650e7cb6c8a91020e568ed46e3551b0 ] The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1] was reverted due to power management ordering concerns and a NO-CARRIER regression. A subsequent attempt to defer net_device allocation to bind [2] broke 1:1 mapping between function instance and network device, making it impossible for configfs to report the resolved interface name. This results in a regression where the DHCP server fails on pmOS. Use device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind/unbind cycles. This preserves the network interface across USB reconnection, allowing the DHCP server to retain their binding. Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use __free(detach_gadget) macro to undo attachment on bind failure. The bind_count ensures device_move executes only on the first bind. [1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel@crapouillou.net/ [2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit.cz/ Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-7-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman [ Use no_free_ptr() since retain_and_null_ptr() is unavailable in Linux 6.6. ] Signed-off-by: Jianqiang kang Signed-off-by: Carlos Llamas Signed-off-by: Sasha Levin

usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop

2026-04-11T12:19:34+00:00

commit e1eabb072c75681f78312c484ccfffb7430f206e upstream. A race condition between gether_disconnect() and eth_stop() leads to a NULL pointer dereference. Specifically, if eth_stop() is triggered concurrently while gether_disconnect() is tearing down the endpoints, eth_stop() attempts to access the cleared endpoint descriptor, causing the following NPE: Unable to handle kernel NULL pointer dereference Call trace: __dwc3_gadget_ep_enable+0x60/0x788 dwc3_gadget_ep_enable+0x70/0xe4 usb_ep_enable+0x60/0x15c eth_stop+0xb8/0x108 Because eth_stop() crashes while holding the dev->lock, the thread running gether_disconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup: Core - Debugging Information for Hardlockup core(7) Call trace: queued_spin_lock_slowpath+0x94/0x488 _raw_spin_lock+0x64/0x6c gether_disconnect+0x19c/0x1e8 ncm_set_alt+0x68/0x1a0 composite_setup+0x6a0/0xc50 The root cause is that the clearing of dev->port_usb in gether_disconnect() is delayed until the end of the function. Move the clearing of dev->port_usb to the very beginning of gether_disconnect() while holding dev->lock. This cuts off the link immediately, ensuring eth_stop() will see dev->port_usb as NULL and safely bail out. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: stable Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails

2025-03-13T11:58:34+00:00

commit 17c2c87c37862c3e95b55f660681cc6e8d66660e upstream. Currently while UDC suspends, u_ether attempts to remote wakeup the host if there are any pending transfers. However, if remote wakeup fails, the UDC remains suspended but the is_suspend flag is not set. And since is_suspend flag isn't set, the subsequent eth_start_xmit() would queue USB requests to suspended UDC. To fix this, bail out from gether_suspend() only if remote wakeup operation is successful. Cc: stable Fixes: 0a1af6dfa077 ("usb: gadget: f_ecm: Add suspend/resume and remote wakeup support") Signed-off-by: Prashanth K Link: https://lore.kernel.org/r/20250212100840.3812153-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: use working speed to calcaulate network bitrate and qlen

2023-08-22T12:48:33+00:00

Take ecm_bitrate() as example, it will be called after gadget device link speed negotiation, consider code if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER), if a gadget device link speed is USB_SPEED_SUPER, gadget_is_superspeed(g) must be true, or not it is a wrong configuration of gadget max support speed. Remove gadget_is_superspeed(g) checking should be safe, and remove other similar operation in ncm, rndis, u_ether. Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/20230803091053.9714-2-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: Fix host MAC address case

2023-05-13T09:46:59+00:00

The CDC-ECM specification [1] requires to send the host MAC address as an uppercase hexadecimal string in chapter "5.4 Ethernet Networking Functional Descriptor": The Unicode character is chosen from the set of values 30h through 39h and 41h through 46h (0-9 and A-F). However, snprintf(.., "%pm", ..) generates a lowercase MAC address string. While most host drivers are tolerant to this, UsbNcm.sys on Windows 10 is not. Instead it uses a different MAC address with all bytes set to zero including and after the first byte containing a lowercase letter. On Windows 11 Microsoft fixed it, but apparently they did not backport the fix. This change fixes the issue by upper-casing the MAC to comply with the specification. [1]: https://www.usb.org/document-library/class-definitions-communication-devices-12, file ECM120.pdf Fixes: bcd4a1c40bee ("usb: gadget: u_ether: construct with default values and add setters/getters") Cc: stable@vger.kernel.org Signed-off-by: Konrad Gräfe Link: https://lore.kernel.org/r/20230505143640.443014-1-k.graefe@gateware.de Signed-off-by: Greg Kroah-Hartman

usb: gadget: f_ecm: Add suspend/resume and remote wakeup support

2023-03-29T08:27:01+00:00

When host sends suspend notification to the device, handle the suspend callbacks in the function driver. Depending on the remote wakeup capability the device can either trigger a remote wakeup or wait for the host initiated resume to resume data transfer. Signed-off-by: Elson Roy Serrao Reviewed-by: Thinh Nguyen Link: https://lore.kernel.org/r/1679694482-16430-7-git-send-email-quic_eserrao@quicinc.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: Don't warn in gether_setup_name_default()

2023-02-15T11:36:22+00:00

The function gether_setup_name_default() is called by various USB ethernet gadget drivers. Calling this function will select a random host and device MAC addresses. A properly working driver should be silent and not warn the user about default MAC addresses selection. Given that the MAC addresses are also printed when the function gether_register_netdev() is called, remove these unnecessary warnings. Signed-off-by: Jon Hunter Reviewed-by: Andrzej Pietrasiewicz Link: https://lore.kernel.org/r/20230209125319.18589-2-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_ether: Convert prints to device prints

2023-02-15T11:36:22+00:00

The USB ethernet gadget driver implements its own print macros which call printk. Device drivers should use the device prints that print the device name. Fortunately, the same macro names are defined in the header file 'linux/usb/composite.h' and these use the device prints. Therefore, remove the local definitions in the USB ethernet gadget driver and use those in 'linux/usb/composite.h'. The only difference is that now the device name is printed instead of the ethernet interface name. Tested using ethernet gadget on Jetson AGX Orin. Signed-off-by: Jon Hunter Tested-by: Jon Hunter Link: https://lore.kernel.org/r/20230209125319.18589-1-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman

Revert "usb: gadget: u_ether: Do not make UDC parent of the net device"

2023-02-09T12:18:24+00:00

This reverts commit 321b59870f850a10dbb211ecd2bd87b41497ea6f. This commit broke USB networking on Ingenic SoCs and maybe elsewhere. The actual reason is unknown; and while a proper fix would be better, we're sitting at -rc7 now, so a revert is justified - and we can work on re-introducing this change for 6.3. Fixes: 321b59870f85 ("usb: gadget: u_ether: Do not make UDC parent of the net device") Signed-off-by: Paul Cercueil Acked-by: Sascha Hauer Link: https://lore.kernel.org/r/20230209105626.10597-1-paul@crapouillou.net Signed-off-by: Greg Kroah-Hartman