Re: [REGRESSION] usb: gadget: u_ether NULL deref in eth_stop after gether_detach_gadget

[Kuen-Han Tsai]

Hi Ivaylo,

Sorry for the late reply - I was on parental leave since May and just
returned this week.

On Wed, May 27, 2026 at 4:37 PM Ivaylo Dimitrov
<ivo.g.dimitrov.75@xxxxxxxxx> wrote:
>
>
>
> On 27.05.26 г. 11:03 ч., Greg Kroah-Hartman wrote:
> > On Tue, May 26, 2026 at 08:56:15AM +0300, Ivaylo Dimitrov wrote:
> >> on linux 6.18.31 I am seeing a NULL pointer dereference during RNDIS gadget
> >> teardown.
> >
> > Does this also happen on the latest 7.1-rc release?
> >
>
> I didn't test this on current -rc (this is a mobile phone and not
> particularly easy to run latest Linux on), however this looks more like
> an object lifetime contract issue than something specific to 6.18.y.
>
> Also, the suspected patch was backported to 6.18.y together with
> e002e92e88e12457373ed096b18716d97e7bbb20 ("usb: gadget: u_ether: Fix
> NULL pointer deref in eth_get_drvinfo"), which fixes a similar issue, so
> I strongly suspect the issue exists in current -rc as well.

Thank you for the detailed report and bisection. The crash happens
because gether_detach_gadget() clears dev->gadget during unbind while
the DBG()/VDBG()/ERROR()/INFO() macros in u_ether.c still dereference
&dev->gadget->dev when eth_stop() runs during function instance
teardown.

>
> >> I suspect the reason is commit:
> >>
> >>    usb: gadget: f_ncm: Fix net_device lifecycle with device_move
> >
> > Do you have a proposed fix for this issue?
> >
>
> Not really, as checking whether dev->gadget is NULL before calling DBG()
> looks more like a workaround than a proper fix to me. I also don't know
> the subsystem well enough to judge whether switching to netdev_dbg()
> instead of DBG() would be appropriate here, or whether that would defeat
> the purpose of the existing debug messages (or cause confusion by mixing
> gadget and netdev based logging).
>
> I could use some maintainer advice on what they think the proper fix
> should look like, and then I'll try to put together a fix.

I have just sent a fix series to convert u_ether.c to netdev_*()
logging helpers (which safely handle unparented net_devices) and to
serialize dev->gadget accesses with dev->lock:
https://lore.kernel.org/r/20260923-u-ether-gadget-npe-v1-0-ff466c55ecc0@xxxxxxxxxx
If you have a chance to test the series, a Tested-by would be much appreciated.

Regards,
Kuen-Han