From nobody Thu Apr 9 03:31:01 2026 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 063803C5DDA for ; Wed, 11 Mar 2026 09:12:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773220363; cv=none; b=jlniUsIn9m6EIAez35rzIEvViYlHLSZ4KdfVduGEQMzCqDwX540+OfSRlVrP3/yZ8KtlVhzhYUqaSpN2y5E1kak9wMjULVX79m/mGypVaCXGEgwRyWzxSJB+tPq9F/TGLA9quKDq+1Nm+pPdl6JDVy+x5g96daN1ZF6Hcip0Hio= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773220363; c=relaxed/simple; bh=IuJEJeZeAA0dtPdJGCR2Y6So5KmMJbEcKNQPLePgIVk=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=bHzzxyoLXBtZtul+8hsk8krdeW8Rf30MfzKdxtCU+R/mHEuDlzF/dtZvhMmgZHJmR939dp/rBv4wzCcCab58kAraL6UiqKwACrybqk4Du9MPvM5JF945pCJbRWTZ9ysRn7nubor623vhXrjWLQEakNgtyea/QkvOXRMcXGDVS0M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=LF5uY5OZ; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="LF5uY5OZ" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-c737b6686ddso4329895a12.3 for ; Wed, 11 Mar 2026 02:12:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1773220354; x=1773825154; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=CfExovoAn7o/levAKL1G/GcHLpVojQhg0czDHj9L5ow=; b=LF5uY5OZctOYzLVhoMiE1XP6YQAez1/qTF8BV54ijBQQ9IYMmFWr2ZJuV3Rmw7mwh+ 7/m9R6bhH2rbCVvMeCVP+HpMEw4PA/HAh6BVbgBA9lTLxnsTBjSFQmfUEe2WZaEtTYPY xsL5cNPfZUNW/AakqiPO0RJ/cz8VKHQ0AZJQKIO5UrTEaRZeeKylrkfjFV0/vqjVO2np zKpF40JHapezhjIbxooK45UwFVW+Tlb4nQApYAxN74ZniyA2O9O7RYHNRkc3f+JpGUjD ptj1afAErakMZpfoahzIeeEpx1meQY3LhoXx4sFUwM4bbgWCpQgIMsbNuWii0LezIq8/ ZC1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773220354; x=1773825154; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=CfExovoAn7o/levAKL1G/GcHLpVojQhg0czDHj9L5ow=; b=HUDOO7+pia0Lovngy6hW6HUHQNDkcLt9cyxdw5J8TQm6r/7HPInLdaRyKzUPpzsUmN 9g0r/DuaGgYLBVmwAXc6hklU5rpVKYkgwKbfbF58K2JXGarHs7svx5MZAn/KsH0iAS/e b2x/HuVLgRmeniuSdfd9qIyX9es0hpTT9yK0CXsX9uOqdsvXpkpfeOqG2ie+x+pYVzrI 4akhPmLsCuySWkMHV1KZ3qNPRMrN/5ey/cB0tcT+W8lOU43zaESsHSJgVXhb9AVY034e v04oo3IX0Z1N26uxkTQf7qHGy2+nl5OzQ1QlfCQn8a3jWif4vl7ODvFsTbKquY4j8Jmn +Jow== X-Forwarded-Encrypted: i=1; AJvYcCX57YuR0FyfkSDZgKRxoWVpFKqp7nP3WrWePPJA8MxZN5ahi9i45wZbUEw8uSSBskfzHSrNxIDeQwV61Y8=@vger.kernel.org X-Gm-Message-State: AOJu0YzCOqm7Nu4PwgDsDR+lkkI3GftL9IoApgGwJopqI7ylf9xOq5Qw 3UifolNsjMod4r0YmStLq+82uGjamXh27mioiE+LesT3abz/TTVWErIqj8dL5fCPCIvxdRZh84k rvxBjkw== X-Received: from pfbbk8.prod.google.com ([2002:aa7:8308:0:b0:829:753a:73c1]) (user=khtsai job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:a110:b0:398:9b42:69f7 with SMTP id adf61e73a8af0-398c60e40e9mr1761475637.39.1773220353942; Wed, 11 Mar 2026 02:12:33 -0700 (PDT) Date: Wed, 11 Mar 2026 17:12:15 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAO4xsWkC/x3MwQpAQBCH8VfRnE0ZIryKHLT7X+YytCspeXeb4 +/wfQ8lREWisXgo4tKku2VIWZDbFlvB6rOpruquakR4xbkhstfkdjO4k+0At30nfugb8SFQbo+ IoPf/neb3/QAKuI/CZwAAAA== X-Change-Id: 20260311-gether-disconnect-npe-5861d9831dff X-Developer-Key: i=khtsai@google.com; a=ed25519; pk=abA4Pw6dY2ZufSbSXW9mtp7xiv1AVPtgRhCFWJSEqLE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1773220352; l=2489; i=khtsai@google.com; s=20250916; h=from:subject:message-id; bh=IuJEJeZeAA0dtPdJGCR2Y6So5KmMJbEcKNQPLePgIVk=; b=RULJ9mQMu2H/bZkTzSiCY3jQvdU2YAWixzuX8Ru1zDG+HqQwUttR/mnK7HLj9mn01Vabu+zY/ I3rYDCiho2GBChi++LgedTLhr40Ti6DPsaTCvVbuYvZucu927qnf03s X-Mailer: b4 0.14.3 Message-ID: <20260311-gether-disconnect-npe-v1-1-454966adf7c7@google.com> Subject: [PATCH] usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop From: Kuen-Han Tsai To: Greg Kroah-Hartman , David Brownell Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Kuen-Han Tsai Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable A race condition between gether_disconnect() and eth_stop() leads to a NULL pointer dereference. Specifically, if eth_stop() is triggered concurrently while gether_disconnect() is tearing down the endpoints, eth_stop() attempts to access the cleared endpoint descriptor, causing the following NPE: Unable to handle kernel NULL pointer dereference Call trace: __dwc3_gadget_ep_enable+0x60/0x788 dwc3_gadget_ep_enable+0x70/0xe4 usb_ep_enable+0x60/0x15c eth_stop+0xb8/0x108 Because eth_stop() crashes while holding the dev->lock, the thread running gether_disconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup: Core - Debugging Information for Hardlockup core(7) Call trace: queued_spin_lock_slowpath+0x94/0x488 _raw_spin_lock+0x64/0x6c gether_disconnect+0x19c/0x1e8 ncm_set_alt+0x68/0x1a0 composite_setup+0x6a0/0xc50 The root cause is that the clearing of dev->port_usb in gether_disconnect() is delayed until the end of the function. Move the clearing of dev->port_usb to the very beginning of gether_disconnect() while holding dev->lock. This cuts off the link immediately, ensuring eth_stop() will see dev->port_usb as NULL and safely bail out. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai --- drivers/usb/gadget/function/u_ether.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/fun= ction/u_ether.c index 338f6e2a85a9..2c970a0eafd9 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -1246,6 +1246,11 @@ void gether_disconnect(struct gether *link) =20 DBG(dev, "%s\n", __func__); =20 + spin_lock(&dev->lock); + dev->port_usb =3D NULL; + link->is_suspend =3D false; + spin_unlock(&dev->lock); + netif_stop_queue(dev->net); netif_carrier_off(dev->net); =20 @@ -1283,11 +1288,6 @@ void gether_disconnect(struct gether *link) dev->header_len =3D 0; dev->unwrap =3D NULL; dev->wrap =3D NULL; - - spin_lock(&dev->lock); - dev->port_usb =3D NULL; - link->is_suspend =3D false; - spin_unlock(&dev->lock); } EXPORT_SYMBOL_GPL(gether_disconnect); =20 --- base-commit: 1be3b77de4eb89af8ae2fd6610546be778e25589 change-id: 20260311-gether-disconnect-npe-5861d9831dff Best regards, --=20 Kuen-Han Tsai