From nobody Mon Apr 6 09:12:08 2026 Received: from mail-pl1-f202.google.com (mail-pl1-f202.google.com [209.85.214.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC05C346AF0 for ; Fri, 20 Mar 2026 08:55:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773996934; cv=none; b=egtUTC49/RWUi95SaQRr3FORdSxtj5pxQKlVnVVnLpSE31xk0Dt+V020KE87Enqt9JJw9AOTIWYyfp2vgbn3NOY+FB9h0Z6kKahuaVgbqVy3F6LRv4I6MlgiyYPHwtcrNr+YC8BZmH8s/dJQTrmiz6TkxQZbztCyRJaYkXNrxkU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773996934; c=relaxed/simple; bh=cPeN1vUKjquyCNuYv+KhJlm53tGodtnOjIR6zLwHcWM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=q8a7nnGEerA4TRtrL1xiCTpyYmK8+TG/L4ITjMIpZC9Q3Z/9ILozVAE9sA4J7eLq1FyMFbE8X2SipHfBXEti09cTBrEqTWNsmr8JIfuH7Ux9iUHdb9yxPl8bIU5TRk4zddGy1TVbRO2c+hWEI7qoCFrEfnjkYa48IRpW7KZGSWU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=oMNDPWHv; arc=none smtp.client-ip=209.85.214.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--khtsai.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="oMNDPWHv" Received: by mail-pl1-f202.google.com with SMTP id d9443c01a7336-2aebfa0af7dso35446385ad.1 for ; Fri, 20 Mar 2026 01:55:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1773996931; x=1774601731; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=q+r6IZRTjAuqtqKkL9NYRrlxIcvlXL5N8kxFoBUFnCk=; b=oMNDPWHv7S6s+UsYL+wxhHq2mcRvWFfNp9QznXXvn49FopPvS7QiDGAflRx735afPt 89bTM/55pyBlQQntLfoZAvY7pQ6j/yZ5RjPdIPGK1CqReBIrM6yrOapNem4fvNfd8fH8 UxzPF9yBls9iR5YtHazkPjrV0XOu9Y/woG0Rrx1UKjBLKc6dkyx+grze8XAeJw+7/cjx PsATQDUAX6/FKUILgTrUhRb019dCx6xIKMZybnRr5/ggNifVfM9jB3bNLxbYFLjeGoUY 0ln46ii8pGzypM1Q1sdnHbv2xSEm01UdV6mUGMQXorkTd9os/prge5lw5FEyuC/L2EYE LobA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773996931; x=1774601731; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=q+r6IZRTjAuqtqKkL9NYRrlxIcvlXL5N8kxFoBUFnCk=; b=MWXwVFdAZVO24CgNxjV9XZPky6ywRaIIpisFhQ6u2dinjGnygIt3WQ79yxhjkv1/S/ +gUabCNxVHP/Rjv78RCgqX01Izm+u6IAtHku+QTuir2BmvLv/UetJZ+Gjpx6IA2TpPqj pXGiwuc3eS48B+16pm2TuZakR5fA0ozVgl1AaxmijzS9SSDYWhLXpyB0eRo7bgSOZllk qG4sIYepCl6C7fmXOW8rpfZBKzKH7UVZYLNYTKtf7uhm75N851JW6PimeXKSYi7WesA9 ZvdN9sCh8hfE2Vy65BidBQnbHhgN5SmMB+rRhDIZPdeHpmGRMaR+b1DtJSBSoAUXCeRA Q8NA== X-Forwarded-Encrypted: i=1; AJvYcCUBARknBVaU3nMS5v9zY8x5W6JDfMtGfLgKX9ao3hbEayw8dFWvtBJ5ZwLO3HrKyq76i2zopeRXSN38G84=@vger.kernel.org X-Gm-Message-State: AOJu0Yzee1oSl5em/HJw3PSEBT/WyOTPDUqKj0JlgfftVgacM4NUSIcD p4Paqn62AjwK8wIaVlqHuGNrDJG0wk01EFqij6iKrZIpzUejV1DB98HUL07ew3ZXB43zkPFM5Un WMCUTQg== X-Received: from pliy14.prod.google.com ([2002:a17:903:3d0e:b0:2ae:5344:9e72]) (user=khtsai job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:2348:b0:2ae:b9cd:d2df with SMTP id d9443c01a7336-2b0827a797amr23492035ad.34.1773996931063; Fri, 20 Mar 2026 01:55:31 -0700 (PDT) Date: Fri, 20 Mar 2026 16:54:50 +0800 In-Reply-To: <20260320-usb-net-lifecycle-v1-0-4886b578161b@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260320-usb-net-lifecycle-v1-0-4886b578161b@google.com> X-Developer-Key: i=khtsai@google.com; a=ed25519; pk=abA4Pw6dY2ZufSbSXW9mtp7xiv1AVPtgRhCFWJSEqLE= X-Developer-Signature: v=1; a=ed25519-sha256; t=1773996915; l=7379; i=khtsai@google.com; s=20250916; h=from:subject:message-id; bh=cPeN1vUKjquyCNuYv+KhJlm53tGodtnOjIR6zLwHcWM=; b=RIX8Pw9NlPIBE4VKtmrY5ajDc9rdW4WzWxkwZJbeAJQUk/Q/hGXLBiEZYwMBcLMkOUDsbThHR dypca3ELtsHBW/YW1Om4xFxztBIxL97VBNgCaMme5HNH74THPYA6vvQ X-Mailer: b4 0.14.3 Message-ID: <20260320-usb-net-lifecycle-v1-7-4886b578161b@google.com> Subject: [PATCH 7/7] usb: gadget: f_rndis: Fix net_device lifecycle with device_move From: Kuen-Han Tsai To: Greg Kroah-Hartman , Kyungmin Park , Felipe Balbi , David Lechner Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Kuen-Han Tsai , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the borrowed_net flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase. Fixes: f466c6353819 ("usb: gadget: f_rndis: convert to new function interfa= ce with backward compatibility") Cc: stable@vger.kernel.org Signed-off-by: Kuen-Han Tsai --- drivers/usb/gadget/function/f_rndis.c | 42 +++++++++++++++++++++----------= ---- drivers/usb/gadget/function/u_rndis.h | 31 +++++++++++++++++++------- 2 files changed, 48 insertions(+), 25 deletions(-) diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/fun= ction/f_rndis.c index 521b4619d6be..7de1c5f8e326 100644 --- a/drivers/usb/gadget/function/f_rndis.c +++ b/drivers/usb/gadget/function/f_rndis.c @@ -666,6 +666,7 @@ rndis_bind(struct usb_configuration *c, struct usb_func= tion *f) =20 struct f_rndis_opts *rndis_opts; struct usb_os_desc_table *os_desc_table __free(kfree) =3D NULL; + struct net_device *net __free(detach_gadget) =3D NULL; struct usb_request *request __free(free_usb_request) =3D NULL; =20 if (!can_support_rndis(c)) @@ -683,21 +684,18 @@ rndis_bind(struct usb_configuration *c, struct usb_fu= nction *f) rndis_iad_descriptor.bFunctionClass =3D rndis_opts->class; rndis_iad_descriptor.bFunctionSubClass =3D rndis_opts->subclass; rndis_iad_descriptor.bFunctionProtocol =3D rndis_opts->protocol; - } =20 - /* - * in drivers/usb/gadget/configfs.c:configfs_composite_bind() - * configurations are bound in sequence with list_for_each_entry, - * in each configuration its functions are bound in sequence - * with list_for_each_entry, so we assume no race condition - * with regard to rndis_opts->bound access - */ - if (!rndis_opts->bound) { - gether_set_gadget(rndis_opts->net, cdev->gadget); - status =3D gether_register_netdev(rndis_opts->net); - if (status) - return status; - rndis_opts->bound =3D true; + if (rndis_opts->bind_count =3D=3D 0 && !rndis_opts->borrowed_net) { + if (!device_is_registered(&rndis_opts->net->dev)) { + gether_set_gadget(rndis_opts->net, cdev->gadget); + status =3D gether_register_netdev(rndis_opts->net); + } else + status =3D gether_attach_gadget(rndis_opts->net, cdev->gadget); + + if (status) + return status; + net =3D rndis_opts->net; + } } =20 us =3D usb_gstrings_attach(cdev, rndis_strings, @@ -796,6 +794,9 @@ rndis_bind(struct usb_configuration *c, struct usb_func= tion *f) } rndis->notify_req =3D no_free_ptr(request); =20 + rndis_opts->bind_count++; + retain_and_null_ptr(net); + /* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code * until we're activated via set_alt(). @@ -812,11 +813,11 @@ void rndis_borrow_net(struct usb_function_instance *f= , struct net_device *net) struct f_rndis_opts *opts; =20 opts =3D container_of(f, struct f_rndis_opts, func_inst); - if (opts->bound) + if (device_is_registered(&opts->net->dev)) gether_cleanup(netdev_priv(opts->net)); else free_netdev(opts->net); - opts->borrowed_net =3D opts->bound =3D true; + opts->borrowed_net =3D true; opts->net =3D net; } EXPORT_SYMBOL_GPL(rndis_borrow_net); @@ -874,7 +875,7 @@ static void rndis_free_inst(struct usb_function_instanc= e *f) =20 opts =3D container_of(f, struct f_rndis_opts, func_inst); if (!opts->borrowed_net) { - if (opts->bound) + if (device_is_registered(&opts->net->dev)) gether_cleanup(netdev_priv(opts->net)); else free_netdev(opts->net); @@ -943,6 +944,9 @@ static void rndis_free(struct usb_function *f) static void rndis_unbind(struct usb_configuration *c, struct usb_function = *f) { struct f_rndis *rndis =3D func_to_rndis(f); + struct f_rndis_opts *rndis_opts; + + rndis_opts =3D container_of(f->fi, struct f_rndis_opts, func_inst); =20 kfree(f->os_desc_table); f->os_desc_n =3D 0; @@ -950,6 +954,10 @@ static void rndis_unbind(struct usb_configuration *c, = struct usb_function *f) =20 kfree(rndis->notify_req->buf); usb_ep_free_request(rndis->notify, rndis->notify_req); + + rndis_opts->bind_count--; + if (rndis_opts->bind_count =3D=3D 0 && !rndis_opts->borrowed_net) + gether_detach_gadget(rndis_opts->net); } =20 static struct usb_function *rndis_alloc(struct usb_function_instance *fi) diff --git a/drivers/usb/gadget/function/u_rndis.h b/drivers/usb/gadget/fun= ction/u_rndis.h index a8c409b2f52f..4e64619714dc 100644 --- a/drivers/usb/gadget/function/u_rndis.h +++ b/drivers/usb/gadget/function/u_rndis.h @@ -15,12 +15,34 @@ =20 #include =20 +/** + * struct f_rndis_opts - RNDIS function options + * @func_inst: USB function instance. + * @vendor_id: Vendor ID. + * @manufacturer: Manufacturer string. + * @net: The net_device associated with the RNDIS function. + * @bind_count: Tracks the number of configurations the RNDIS function is + * bound to, preventing double-registration of the @net devic= e. + * @borrowed_net: True if the net_device is shared and pre-registered duri= ng + * the legacy composite driver's bind phase (e.g., multi.c). + * If false, the RNDIS function will register the net_device + * during its own bind phase. + * @rndis_interf_group: ConfigFS group for RNDIS interface. + * @rndis_os_desc: USB OS descriptor for RNDIS. + * @rndis_ext_compat_id: Extended compatibility ID. + * @class: USB class. + * @subclass: USB subclass. + * @protocol: USB protocol. + * @lock: Protects the data from concurrent access by configfs read/write + * and create symlink/remove symlink operations. + * @refcnt: Reference counter for the function instance. + */ struct f_rndis_opts { struct usb_function_instance func_inst; u32 vendor_id; const char *manufacturer; struct net_device *net; - bool bound; + int bind_count; bool borrowed_net; =20 struct config_group *rndis_interf_group; @@ -30,13 +52,6 @@ struct f_rndis_opts { u8 class; u8 subclass; u8 protocol; - - /* - * Read/write access to configfs attributes is handled by configfs. - * - * This is to protect the data from concurrent access by read/write - * and create symlink/remove symlink. - */ struct mutex lock; int refcnt; }; --=20 2.53.0.959.g497ff81fa9-goog