usb: gadget: f_ecm: Fix net_device lifecycle with device_move

The net_device is allocated during function instance creation and
registered during the bind phase with the gadget device as its sysfs
parent. When the function unbinds, the parent device is destroyed, but
the net_device survives, resulting in dangling sysfs symlinks:

  console:/ # ls -l /sys/class/net/usb0
  lrwxrwxrwx ... /sys/class/net/usb0 ->
  /sys/devices/platform/.../gadget.0/net/usb0
  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0
  ls: .../gadget.0/net/usb0: No such file or directory

Use device_move() to reparent the net_device between the gadget device
tree and /sys/devices/virtual across bind and unbind cycles. During the
final unbind, calling device_move(NULL) moves the net_device to the
virtual device tree before the gadget device is destroyed. On rebinding,
device_move() reparents the device back under the new gadget, ensuring
proper sysfs topology and power management ordering.

To maintain compatibility with legacy composite drivers (e.g., multi.c),
the bound flag is used to indicate whether the network device is shared
and pre-registered during the legacy driver's bind phase.

Fixes: fee562a6450b ("usb: gadget: f_ecm: convert to new function interface with backward compatibility")
Cc: stable@vger.kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20260320-usb-net-lifecycle-v1-4-4886b578161b@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
index e0c02121374e0d4b704e1ab0a96d3b61d827eec6..e495bac4efeb5a39107a09d06b69ba86eaab1926 100644 (file)
--- a/drivers/usb/gadget/function/f_ecm.c
+++ b/drivers/usb/gadget/function/f_ecm.c
@@ -681,6 +681,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
        struct usb_ep           *ep;
 
        struct f_ecm_opts       *ecm_opts;
+       struct net_device       *net __free(detach_gadget) = NULL;
        struct usb_request      *request __free(free_usb_request) = NULL;
 
        if (!can_support_ecm(cdev->gadget))
@@ -688,18 +689,18 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
 
        ecm_opts = container_of(f->fi, struct f_ecm_opts, func_inst);
 
-       mutex_lock(&ecm_opts->lock);
-
-       gether_set_gadget(ecm_opts->net, cdev->gadget);
-
-       if (!ecm_opts->bound) {
-               status = gether_register_netdev(ecm_opts->net);
-               ecm_opts->bound = true;
-       }
-
-       mutex_unlock(&ecm_opts->lock);
-       if (status)
-               return status;
+       scoped_guard(mutex, &ecm_opts->lock)
+               if (ecm_opts->bind_count == 0 && !ecm_opts->bound) {
+                       if (!device_is_registered(&ecm_opts->net->dev)) {
+                               gether_set_gadget(ecm_opts->net, cdev->gadget);
+                               status = gether_register_netdev(ecm_opts->net);
+                       } else
+                               status = gether_attach_gadget(ecm_opts->net, cdev->gadget);
+
+                       if (status)
+                               return status;
+                       net = ecm_opts->net;
+               }
 
        ecm_string_defs[1].s = ecm->ethaddr;
 
@@ -790,6 +791,9 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
 
        ecm->notify_req = no_free_ptr(request);
 
+       ecm_opts->bind_count++;
+       retain_and_null_ptr(net);
+
        DBG(cdev, "CDC Ethernet: IN/%s OUT/%s NOTIFY/%s\n",
                        ecm->port.in_ep->name, ecm->port.out_ep->name,
                        ecm->notify->name);
@@ -836,7 +840,7 @@ static void ecm_free_inst(struct usb_function_instance *f)
        struct f_ecm_opts *opts;
 
        opts = container_of(f, struct f_ecm_opts, func_inst);
-       if (opts->bound)
+       if (device_is_registered(&opts->net->dev))
                gether_cleanup(netdev_priv(opts->net));
        else
                free_netdev(opts->net);
@@ -906,9 +910,12 @@ static void ecm_free(struct usb_function *f)
 static void ecm_unbind(struct usb_configuration *c, struct usb_function *f)
 {
        struct f_ecm            *ecm = func_to_ecm(f);
+       struct f_ecm_opts       *ecm_opts;
 
        DBG(c->cdev, "ecm unbind\n");
 
+       ecm_opts = container_of(f->fi, struct f_ecm_opts, func_inst);
+
        usb_free_all_descriptors(f);
 
        if (atomic_read(&ecm->notify_count)) {
@@ -918,6 +925,10 @@ static void ecm_unbind(struct usb_configuration *c, struct usb_function *f)
 
        kfree(ecm->notify_req->buf);
        usb_ep_free_request(ecm->notify, ecm->notify_req);
+
+       ecm_opts->bind_count--;
+       if (ecm_opts->bind_count == 0 && !ecm_opts->bound)
+               gether_detach_gadget(ecm_opts->net);
 }
 
 static struct usb_function *ecm_alloc(struct usb_function_instance *fi)

diff --git a/drivers/usb/gadget/function/u_ecm.h b/drivers/usb/gadget/function/u_ecm.h
index 77cfb89932bea72adc09e7a62fab32f3a2c3ddee..7f666b9dea02658464e5522a20c2082e3b27596c 100644 (file)
--- a/drivers/usb/gadget/function/u_ecm.h
+++ b/drivers/usb/gadget/function/u_ecm.h
@@ -15,17 +15,26 @@
 
 #include <linux/usb/composite.h>
 
+/**
+ * struct f_ecm_opts - ECM function options
+ * @func_inst: USB function instance.
+ * @net: The net_device associated with the ECM function.
+ * @bound: True if the net_device is shared and pre-registered during the
+ *         legacy composite driver's bind phase (e.g., multi.c). If false,
+ *         the ECM function will register the net_device during its own
+ *         bind phase.
+ * @bind_count: Tracks the number of configurations the ECM function is
+ *              bound to, preventing double-registration of the @net device.
+ * @lock: Protects the data from concurrent access by configfs read/write
+ *        and create symlink/remove symlink operations.
+ * @refcnt: Reference counter for the function instance.
+ */
 struct f_ecm_opts {
        struct usb_function_instance    func_inst;
        struct net_device               *net;
        bool                            bound;
+       int                             bind_count;
 
-       /*
-        * Read/write access to configfs attributes is handled by configfs.
-        *
-        * This is to protect the data from concurrent access by read/write
-        * and create symlink/remove symlink.
-        */
        struct mutex                    lock;
        int                             refcnt;
 };