FAILED: patch "[PATCH] usb: gadget: f_ecm: Refactor bind path to use __free()" failed to apply to 6.17-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.17-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.17.y
git checkout FETCH_HEAD
git cherry-pick -x 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025101640-mastiff-grimace-b0aa@gregkh' --subject-prefix 'PATCH 6.17.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5 Mon Sep 17 00:00:00 2001
From: Kuen-Han Tsai <[email protected]>
Date: Tue, 16 Sep 2025 16:21:36 +0800
Subject: [PATCH] usb: gadget: f_ecm: Refactor bind path to use __free()
After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
drivers/usb/gadget/function/f_ecm.c +20 -28
@@ -8,6 +8,7 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h>
@@ -15,6 +16,8 @@#include <linux/etherdevice.h> #include <linux/string_choices.h> +#include <linux/usb/gadget.h> +#include "u_ether.h" #include "u_ether_configfs.h" #include "u_ecm.h"
@@ -678,6 +681,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)struct usb_ep *ep;struct f_ecm_opts *ecm_opts; + struct usb_request *request __free(free_usb_request) = NULL;if (!can_support_ecm (cdev->gadget))return -EINVAL ;
@@ -711,7 +715,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->ctrl_id = status; ecm_iad_descriptor.bFirstInterface = status;
@@ -720,24 +724,22 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->data_id = status; ecm_data_nop_intf.bInterfaceNumber = status; ecm_data_intf.bInterfaceNumber = status; ecm_union_desc.bSlaveInterface0 = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_in_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_out_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.out_ep = ep;/* NOTE: a status/notification endpoint is *OPTIONAL* but we
@@ -746,20 +748,18 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)*/ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_notify_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - ecm->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!ecm->notify_req) - goto fail; - ecm->notify_req->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!ecm->notify_req->buf) - goto fail; - ecm->notify_req->context = ecm; - ecm->notify_req->complete = ecm_notify_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->context = ecm; + request->complete = ecm_notify_complete;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -778,7 +778,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) status =usb_assign_descriptors (f, ecm_fs_function, ecm_hs_function, ecm_ss_function, ecm_ss_function);if (status) - goto fail; +return status;/* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code
@@ -788,20 +788,12 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) ecm->port.open = ecm_open; ecm->port.close = ecm_close; + ecm->notify_req =no_free_ptr (request); +DBG (cdev,"CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n" , ecm->port.in_ep->name, ecm->port.out_ep->name, ecm->notify->name);return 0 ; - -fail: -if (ecm->notify_req) { -kfree (ecm->notify_req->buf); -usb_ep_free_request (ecm->notify, ecm->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }static inline struct f_ecm_opts *to_f_ecm_opts (struct config_item *item)
Sasha Levin
maintainerPATCH 1/3 usb: gadget: Store endpoint pointer in usb_request
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit bfb1d99d969fe3b892db30848aeebfa19d21f57f ]
Gadget function drivers often have goto-based error handling in their bind paths, which can be bug-prone. Refactoring these paths to use __free() scope-based cleanup is desirable, but currently blocked.
The blocker is that usb_ep_free_request(ep, req) requires two parameters, while the __free() mechanism can only pass a pointer to the request itself.
Store an endpoint pointer in the struct usb_request. The pointer is populated centrally in usb_ep_alloc_request() on every successful allocation, making the request object self-contained.
Stable-dep-of: 42988380ac67 ("usb: gadget: f_ecm: Refactor bind path to use __free()")
--- drivers/usb/gadget/udc/core.c | 3 +++ include/linux/usb/gadget.h | 2 ++ 2 files changed, 5 insertions(+)
drivers/usb/gadget/udc/core.c +3 -0
@@ -194,6 +194,9 @@ struct usb_request *usb_ep_alloc_request(struct usb_ep *ep, req = ep->ops->alloc_request (ep, gfp_flags); +if (req) + req->ep = ep; +trace_usb_ep_alloc_request (ep, req, req ?0 : -ENOMEM );return req;
include/linux/usb/gadget.h +2 -0
@@ -32,6 +32,7 @@ struct usb_ep;/** * struct usb_request - describes one i/o request +* @ep: The associated endpoint set by usb_ep_alloc_request(). * @buf: Buffer used for data. Always provide this; some controllers * only use PIO, or don't use DMA for some endpoints. * @dma: DMA address corresponding to 'buf'. If you don't set this
@@ -98,6 +99,7 @@ struct usb_ep;*/ struct usb_request { +struct usb_ep *ep;void *buf;unsigned length;dma_addr_t dma;
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 2/3 usb: gadget: Introduce free_usb_request helper
From: Kuen-Han Tsai <[email protected]>
[ Upstream commit 201c53c687f2b55a7cc6d9f4000af4797860174b ]
Introduce the free_usb_request() function that frees both the request's buffer and the request itself.
This function serves as the cleanup callback for DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request pointers.
Stable-dep-of: 42988380ac67 ("usb: gadget: f_ecm: Refactor bind path to use __free()")
--- include/linux/usb/gadget.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
include/linux/usb/gadget.h +23 -0
@@ -15,6 +15,7 @@#ifndef __LINUX_USB_GADGET_H#define __LINUX_USB_GADGET_H +#include <linux/cleanup.h> #include <linux/configfs.h> #include <linux/device.h> #include <linux/errno.h>
@@ -293,6 +294,28 @@ static inline void usb_ep_fifo_flush(struct usb_ep *ep)/*-------------------------------------------------------------------------*/ +/** +* free_usb_request - frees a usb_request object and its buffer +* @req: the request being freed +* +* This helper function frees both the request's buffer and the request object +* itself by calling usb_ep_free_request(). Its signature is designed to be used +* with DEFINE_FREE() to enable automatic, scope-based cleanup for usb_request +* pointers. +*/ +static inline void free_usb_request (struct usb_request *req) +{ +if (!req) +return ; + +kfree (req->buf); +usb_ep_free_request (req->ep, req); +} + +DEFINE_FREE(free_usb_request, struct usb_request *, free_usb_request(_T)) + +/*-------------------------------------------------------------------------*/ +struct usb_dcd_config_params {__u8 bU1devExitLat;/* U1 Device exit Latency */ #define USB_DEFAULT_U1_DEV_EXIT_LAT 0x01/* Less then 1 microsec */
Signature · 1 line
2.51.0
Sasha Levin
maintainerPATCH 3/3 usb: gadget: f_ecm: Refactor bind path to use __free()
In reply to Sasha LevinFrom: Kuen-Han Tsai <[email protected]>
[ Upstream commit 42988380ac67c76bb9dff8f77d7ef3eefd50b7b5 ]
After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.
Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
--- drivers/usb/gadget/function/f_ecm.c | 48 ++++++++++++----------------- 1 file changed, 20 insertions(+), 28 deletions(-)
drivers/usb/gadget/function/f_ecm.c +20 -28
@@ -8,6 +8,7 @@/* #define VERBOSE_DEBUG */ +#include <linux/cleanup.h> #include <linux/slab.h> #include <linux/kernel.h> #include <linux/module.h>
@@ -15,6 +16,8 @@#include <linux/etherdevice.h> #include <linux/string_choices.h> +#include <linux/usb/gadget.h> +#include "u_ether.h" #include "u_ether_configfs.h" #include "u_ecm.h"
@@ -678,6 +681,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)struct usb_ep *ep;struct f_ecm_opts *ecm_opts; + struct usb_request *request __free(free_usb_request) = NULL;if (!can_support_ecm (cdev->gadget))return -EINVAL ;
@@ -711,7 +715,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)/* allocate instance-specific interface IDs */ status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->ctrl_id = status; ecm_iad_descriptor.bFirstInterface = status;
@@ -720,24 +724,22 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) status =usb_interface_id (c, f);if (status <0 ) - goto fail; +return status; ecm->data_id = status; ecm_data_nop_intf.bInterfaceNumber = status; ecm_data_intf.bInterfaceNumber = status; ecm_union_desc.bSlaveInterface0 = status; - status = -ENODEV ; -/* allocate instance-specific endpoints */ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_in_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.in_ep = ep; ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_out_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->port.out_ep = ep;/* NOTE: a status/notification endpoint is *OPTIONAL* but we
@@ -746,20 +748,18 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)*/ ep =usb_ep_autoconfig (cdev->gadget, &fs_ecm_notify_desc);if (!ep) - goto fail; +return -ENODEV ; ecm->notify = ep; - status = -ENOMEM ; -/* allocate notification request and buffer */ - ecm->notify_req =usb_ep_alloc_request (ep,GFP_KERNEL ); -if (!ecm->notify_req) - goto fail; - ecm->notify_req->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); -if (!ecm->notify_req->buf) - goto fail; - ecm->notify_req->context = ecm; - ecm->notify_req->complete = ecm_notify_complete; + request =usb_ep_alloc_request (ep,GFP_KERNEL ); +if (!request) +return -ENOMEM ; + request->buf =kmalloc (ECM_STATUS_BYTECOUNT ,GFP_KERNEL ); +if (!request->buf) +return -ENOMEM ; + request->context = ecm; + request->complete = ecm_notify_complete;/* support all relevant hardware speeds... we expect that when * hardware is dual speed, all bulk-capable endpoints work at
@@ -778,7 +778,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) status =usb_assign_descriptors (f, ecm_fs_function, ecm_hs_function, ecm_ss_function, ecm_ss_function);if (status) - goto fail; +return status;/* NOTE: all that is done without knowing or caring about * the network link ... which is unavailable to this code
@@ -788,20 +788,12 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) ecm->port.open = ecm_open; ecm->port.close = ecm_close; + ecm->notify_req =no_free_ptr (request); +DBG (cdev,"CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n" , ecm->port.in_ep->name, ecm->port.out_ep->name, ecm->notify->name);return 0 ; - -fail: -if (ecm->notify_req) { -kfree (ecm->notify_req->buf); -usb_ep_free_request (ecm->notify, ecm->notify_req); - } - -ERROR (cdev,"%s: can't bind, err %d\n" , f->name, status); - -return status; }static inline struct f_ecm_opts *to_f_ecm_opts (struct config_item *item)
Signature · 1 line
2.51.0