drivers/usb/gadget/function/u_ether.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
A race condition between gether_disconnect() and eth_stop() leads to a
NULL pointer dereference. Specifically, if eth_stop() is triggered
concurrently while gether_disconnect() is tearing down the endpoints,
eth_stop() attempts to access the cleared endpoint descriptor, causing
the following NPE:
Unable to handle kernel NULL pointer dereference
Call trace:
__dwc3_gadget_ep_enable+0x60/0x788
dwc3_gadget_ep_enable+0x70/0xe4
usb_ep_enable+0x60/0x15c
eth_stop+0xb8/0x108
Because eth_stop() crashes while holding the dev->lock, the thread
running gether_disconnect() fails to acquire the same lock and spins
forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7)
Call trace:
queued_spin_lock_slowpath+0x94/0x488
_raw_spin_lock+0x64/0x6c
gether_disconnect+0x19c/0x1e8
ncm_set_alt+0x68/0x1a0
composite_setup+0x6a0/0xc50
The root cause is that the clearing of dev->port_usb in
gether_disconnect() is delayed until the end of the function.
Move the clearing of dev->port_usb to the very beginning of
gether_disconnect() while holding dev->lock. This cuts off the link
immediately, ensuring eth_stop() will see dev->port_usb as NULL and
safely bail out.
Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
drivers/usb/gadget/function/u_ether.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index 338f6e2a85a9..2c970a0eafd9 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
DBG(dev, "%s\n", __func__);
+ spin_lock(&dev->lock);
+ dev->port_usb = NULL;
+ link->is_suspend = false;
+ spin_unlock(&dev->lock);
+
netif_stop_queue(dev->net);
netif_carrier_off(dev->net);
@@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
dev->header_len = 0;
dev->unwrap = NULL;
dev->wrap = NULL;
-
- spin_lock(&dev->lock);
- dev->port_usb = NULL;
- link->is_suspend = false;
- spin_unlock(&dev->lock);
}
EXPORT_SYMBOL_GPL(gether_disconnect);
---
base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
change-id: 20260311-gether-disconnect-npe-5861d9831dff
Best regards,
--
Kuen-Han Tsai <khtsai@google.com>On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Thu, Mar 26, 2026 at 03:53:13PM +0800, Dayu Jiang wrote: > On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote: > > A race condition between gether_disconnect() and eth_stop() leads to a > > NULL pointer dereference. Specifically, if eth_stop() is triggered > > concurrently while gether_disconnect() is tearing down the endpoints, > > eth_stop() attempts to access the cleared endpoint descriptor, causing > > the following NPE: > > > > Unable to handle kernel NULL pointer dereference > > Call trace: > > __dwc3_gadget_ep_enable+0x60/0x788 > > dwc3_gadget_ep_enable+0x70/0xe4 > > usb_ep_enable+0x60/0x15c > > eth_stop+0xb8/0x108 > > > > Because eth_stop() crashes while holding the dev->lock, the thread > > running gether_disconnect() fails to acquire the same lock and spins > > forever, resulting in a hardlockup: > > > > Core - Debugging Information for Hardlockup core(7) > > Call trace: > > queued_spin_lock_slowpath+0x94/0x488 > > _raw_spin_lock+0x64/0x6c > > gether_disconnect+0x19c/0x1e8 > > ncm_set_alt+0x68/0x1a0 > > composite_setup+0x6a0/0xc50 > > > Hi Greg, > Hit the same issue during NCM switch stress test. > Can you take a look at this patch and check if it’s ready for merge? This is already in my tree and in linux-next and will go to Linus this weekend. thanks, greg k-h
On Thu, Mar 26, 2026 at 11:35:31AM +0100, Greg Kroah-Hartman wrote: > On Thu, Mar 26, 2026 at 03:53:13PM +0800, Dayu Jiang wrote: > > On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote: > > > A race condition between gether_disconnect() and eth_stop() leads to a > > > NULL pointer dereference. Specifically, if eth_stop() is triggered > > > concurrently while gether_disconnect() is tearing down the endpoints, > > > eth_stop() attempts to access the cleared endpoint descriptor, causing > > > the following NPE: > > > > > > Unable to handle kernel NULL pointer dereference > > > Call trace: > > > __dwc3_gadget_ep_enable+0x60/0x788 > > > dwc3_gadget_ep_enable+0x70/0xe4 > > > usb_ep_enable+0x60/0x15c > > > eth_stop+0xb8/0x108 > > > > > > Because eth_stop() crashes while holding the dev->lock, the thread > > > running gether_disconnect() fails to acquire the same lock and spins > > > forever, resulting in a hardlockup: > > > > > > Core - Debugging Information for Hardlockup core(7) > > > Call trace: > > > queued_spin_lock_slowpath+0x94/0x488 > > > _raw_spin_lock+0x64/0x6c > > > gether_disconnect+0x19c/0x1e8 > > > ncm_set_alt+0x68/0x1a0 > > > composite_setup+0x6a0/0xc50 > > > > > Hi Greg, > > Hit the same issue during NCM switch stress test. > > Can you take a look at this patch and check if it’s ready for merge? > > This is already in my tree and in linux-next and will go to Linus this > weekend. Got it. Sorry for the multiple copies of the same email—our mail server had some issues and sent them repeatedly. My apologies for the noise. > > thanks, > > greg k-h
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
>
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
On Wed, Mar 11, 2026 at 05:12:15PM +0800, Kuen-Han Tsai wrote:
> A race condition between gether_disconnect() and eth_stop() leads to a
> NULL pointer dereference. Specifically, if eth_stop() is triggered
> concurrently while gether_disconnect() is tearing down the endpoints,
> eth_stop() attempts to access the cleared endpoint descriptor, causing
> the following NPE:
>
> Unable to handle kernel NULL pointer dereference
> Call trace:
> __dwc3_gadget_ep_enable+0x60/0x788
> dwc3_gadget_ep_enable+0x70/0xe4
> usb_ep_enable+0x60/0x15c
> eth_stop+0xb8/0x108
>
> Because eth_stop() crashes while holding the dev->lock, the thread
> running gether_disconnect() fails to acquire the same lock and spins
> forever, resulting in a hardlockup:
>
> Core - Debugging Information for Hardlockup core(7)
> Call trace:
> queued_spin_lock_slowpath+0x94/0x488
> _raw_spin_lock+0x64/0x6c
> gether_disconnect+0x19c/0x1e8
> ncm_set_alt+0x68/0x1a0
> composite_setup+0x6a0/0xc50
>
> The root cause is that the clearing of dev->port_usb in
> gether_disconnect() is delayed until the end of the function.
>
> Move the clearing of dev->port_usb to the very beginning of
> gether_disconnect() while holding dev->lock. This cuts off the link
> immediately, ensuring eth_stop() will see dev->port_usb as NULL and
> safely bail out.
Hi Greg,
Hit the same issue during NCM switch stress test.
Can you take a look at this patch and check if it’s ready for merge?
Thanks,
Dayu Jiang
>
> Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> drivers/usb/gadget/function/u_ether.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 338f6e2a85a9..2c970a0eafd9 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link)
>
> DBG(dev, "%s\n", __func__);
>
> + spin_lock(&dev->lock);
> + dev->port_usb = NULL;
> + link->is_suspend = false;
> + spin_unlock(&dev->lock);
> +
> netif_stop_queue(dev->net);
> netif_carrier_off(dev->net);
>
> @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link)
> dev->header_len = 0;
> dev->unwrap = NULL;
> dev->wrap = NULL;
> -
> - spin_lock(&dev->lock);
> - dev->port_usb = NULL;
> - link->is_suspend = false;
> - spin_unlock(&dev->lock);
> }
> EXPORT_SYMBOL_GPL(gether_disconnect);
>
>
> ---
> base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589
> change-id: 20260311-gether-disconnect-npe-5861d9831dff
>
> Best regards,
> --
> Kuen-Han Tsai <khtsai@google.com>
>
© 2016 - 2026 Red Hat, Inc.