[PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[Kuen-Han Tsai]

Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
with bind/unbind") addressed a lifetime mismatch where the network
interface outlived the parent gadget. However, this introduced two
regressions:

1. A NULL pointer dereference in the legacy g_ncm driver. The legacy
   driver attempts to access the net_device during its binding process
   before the NCM function driver is fully initialized.

2. A "sleeping function called from atomic context" error in f_ncm.
   The current implementation holds a mutex which might sleep within
   an atomic context.

To resolve these, store the configuration parameters (qmult, host_addr,
dev_addr) in opts_net until the network device is ready for g_ncm.
Additionally, remove the net_device pointer from the f_ncm_opts
structure. This eliminates the race condition with configfs and allows
dropping the mutex, preventing the atomic sleep issue.

Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
Changes in v2:
- Remove the RFC tag.
- Fix NPE in gncm reported by the kernel test bot.
- Fix a "sleeping function called from atomic context" error.
- Link to v1: https://lore.kernel.org/r/20260214-legacy-ncm-v1-1-139c5bcc6636@google.com

---
Kuen-Han Tsai (2):
      usb: legacy: ncm: Fix NPE in gncm_bind
      usb: gadget: f_ncm: Fix atomic context locking issue

 drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
 drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
 drivers/usb/gadget/function/u_ncm.h            |  1 -
 drivers/usb/gadget/legacy/ncm.c                | 13 +++++++++---
 4 files changed, 23 insertions(+), 31 deletions(-)
---
base-commit: da87d45b195148d670ab995367d52aa9e8a9a1fa
change-id: 20260214-legacy-ncm-8c001295b343

Best regards,
-- 
Kuen-Han Tsai <khtsai@google.com>

[PATCH v2 1/2] usb: legacy: ncm: Fix NPE in gncm_bind

[Kuen-Han Tsai]

Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
with bind/unbind") deferred the allocation of the net_device. This
change leads to a NULL pointer dereference in the legacy NCM driver as
it attempts to access the net_device before it's fully instantiated.

Store the provided qmult, host_addr, and dev_addr into the struct
ncm_opts->net_opts during gncm_bind(). These values will be properly
applied to the net_device when it is allocated and configured later in
the binding process by the NCM function driver.

Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind")
Cc: stable@kernel.org
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202602181727.fd76c561-lkp@intel.com
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
 drivers/usb/gadget/legacy/ncm.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/legacy/ncm.c b/drivers/usb/gadget/legacy/ncm.c
index 0f1b45e3abd1a1ead7b2776be10a2a5747960136..e8d5655340530aa38fde698f876e785122f0cce8 100644
--- a/drivers/usb/gadget/legacy/ncm.c
+++ b/drivers/usb/gadget/legacy/ncm.c
@@ -15,8 +15,10 @@
 /* #define DEBUG */
 /* #define VERBOSE_DEBUG */
 
+#include <linux/hex.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/string.h>
 #include <linux/usb/composite.h>
 
 #include "u_ether.h"
@@ -129,6 +131,7 @@ static int gncm_bind(struct usb_composite_dev *cdev)
 	struct usb_gadget	*gadget = cdev->gadget;
 	struct f_ncm_opts	*ncm_opts;
 	int			status;
+	u8			mac[ETH_ALEN];
 
 	f_ncm_inst = usb_get_function_instance("ncm");
 	if (IS_ERR(f_ncm_inst))
@@ -136,11 +139,15 @@ static int gncm_bind(struct usb_composite_dev *cdev)
 
 	ncm_opts = container_of(f_ncm_inst, struct f_ncm_opts, func_inst);
 
-	gether_set_qmult(ncm_opts->net, qmult);
-	if (!gether_set_host_addr(ncm_opts->net, host_addr))
+	ncm_opts->net_opts.qmult = qmult;
+	if (host_addr && mac_pton(host_addr, mac)) {
+		memcpy(&ncm_opts->net_opts.host_mac, mac, ETH_ALEN);
 		pr_info("using host ethernet address: %s", host_addr);
-	if (!gether_set_dev_addr(ncm_opts->net, dev_addr))
+	}
+	if (dev_addr && mac_pton(dev_addr, mac)) {
+		memcpy(&ncm_opts->net_opts.dev_mac, mac, ETH_ALEN);
 		pr_info("using self ethernet address: %s", dev_addr);
+	}
 
 	/* Allocate string descriptor numbers ... note that string
 	 * contents can be overridden by the composite_dev glue.

-- 
2.53.0.345.g96ddfc5eaa-goog

[PATCH v2 2/2] usb: gadget: f_ncm: Fix atomic context locking issue

[Kuen-Han Tsai]

The ncm_set_alt function was holding a mutex to protect against races
with configfs, which invokes the might-sleep function inside an atomic
context.

Remove the struct net_device pointer from the f_ncm_opts structure to
eliminate the contention. The connection state is now managed by a new
boolean flag to preserve the use-after-free fix from
commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind
after usb ep transport error").

BUG: sleeping function called from invalid context
Call Trace:
 dump_stack_lvl+0x83/0xc0
 dump_stack+0x14/0x16
 __might_resched+0x389/0x4c0
 __might_sleep+0x8e/0x100
 ...
 __mutex_lock+0x6f/0x1740
 ...
 ncm_set_alt+0x209/0xa40
 set_config+0x6b6/0xb40
 composite_setup+0x734/0x2b40
 ...

Fixes: 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
 drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
 drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
 drivers/usb/gadget/function/u_ncm.h            |  1 -
 3 files changed, 13 insertions(+), 28 deletions(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index e23adc132f8865f6bbce6c88c8b5f3f06110faaa..6f074b85eebcf93a67e0fbc3b0fecaf702286f83 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -58,6 +58,7 @@ struct f_ncm {
 	u8				notify_state;
 	atomic_t			notify_count;
 	bool				is_open;
+	bool				is_connected;
 
 	const struct ndp_parser_opts	*parser_opts;
 	bool				is_crc;
@@ -864,7 +865,6 @@ static int ncm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
 	struct f_ncm		*ncm = func_to_ncm(f);
-	struct f_ncm_opts	*opts = func_to_ncm_opts(f);
 	struct usb_composite_dev *cdev = f->config->cdev;
 
 	/* Control interface has only altsetting 0 */
@@ -887,13 +887,12 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 		if (alt > 1)
 			goto fail;
 
-		scoped_guard(mutex, &opts->lock)
-			if (opts->net) {
-				DBG(cdev, "reset ncm\n");
-				opts->net = NULL;
-				gether_disconnect(&ncm->port);
-				ncm_reset_values(ncm);
-			}
+		if (ncm->is_connected) {
+			DBG(cdev, "reset ncm\n");
+			ncm->is_connected = false;
+			gether_disconnect(&ncm->port);
+			ncm_reset_values(ncm);
+		}
 
 		/*
 		 * CDC Network only sends data in non-default altsettings.
@@ -926,8 +925,7 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 			net = gether_connect(&ncm->port);
 			if (IS_ERR(net))
 				return PTR_ERR(net);
-			scoped_guard(mutex, &opts->lock)
-				opts->net = net;
+			ncm->is_connected = true;
 		}
 
 		spin_lock(&ncm->lock);
@@ -1374,16 +1372,14 @@ static int ncm_unwrap_ntb(struct gether *port,
 static void ncm_disable(struct usb_function *f)
 {
 	struct f_ncm		*ncm = func_to_ncm(f);
-	struct f_ncm_opts	*opts = func_to_ncm_opts(f);
 	struct usb_composite_dev *cdev = f->config->cdev;
 
 	DBG(cdev, "ncm deactivated\n");
 
-	scoped_guard(mutex, &opts->lock)
-		if (opts->net) {
-			opts->net = NULL;
-			gether_disconnect(&ncm->port);
-		}
+	if (ncm->is_connected) {
+		ncm->is_connected = false;
+		gether_disconnect(&ncm->port);
+	}
 
 	if (ncm->notify->enabled) {
 		usb_ep_disable(ncm->notify);
@@ -1687,7 +1683,6 @@ static struct usb_function_instance *ncm_alloc_inst(void)
 	if (!opts)
 		return ERR_PTR(-ENOMEM);
 
-	opts->net = NULL;
 	opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;
 	gether_setup_opts_default(&opts->net_opts, "usb");
 
diff --git a/drivers/usb/gadget/function/u_ether_configfs.h b/drivers/usb/gadget/function/u_ether_configfs.h
index 217990a266b2f6528d7bf8537a77214c538f681a..25d8fb05b598d68268cf849f260b435f9c52337c 100644
--- a/drivers/usb/gadget/function/u_ether_configfs.h
+++ b/drivers/usb/gadget/function/u_ether_configfs.h
@@ -327,18 +327,9 @@ out:									\
 					      char *page)			\
 	{									\
 		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);		\
-		const char *name;						\
 										\
 		guard(mutex)(&opts->lock);					\
-		rtnl_lock();							\
-		if (opts->net_opts.ifname_set)					\
-			name = opts->net_opts.name;				\
-		else if (opts->net)						\
-			name = netdev_name(opts->net);				\
-		else								\
-			name = "(inactive net_device)";				\
-		rtnl_unlock();							\
-		return sysfs_emit(page, "%s\n", name);				\
+		return sysfs_emit(page, "%s\n", opts->net_opts.name);		\
 	}									\
 										\
 	static ssize_t _f_##_opts_ifname_store(struct config_item *item,	\
diff --git a/drivers/usb/gadget/function/u_ncm.h b/drivers/usb/gadget/function/u_ncm.h
index d99330fe31e880f636615774d212062952c31e43..6d75388557448e7acebf2401f8da48105f740e2f 100644
--- a/drivers/usb/gadget/function/u_ncm.h
+++ b/drivers/usb/gadget/function/u_ncm.h
@@ -19,7 +19,6 @@
 
 struct f_ncm_opts {
 	struct usb_function_instance	func_inst;
-	struct net_device		*net;
 
 	struct gether_opts		net_opts;
 	struct config_group		*ncm_interf_group;

-- 
2.53.0.345.g96ddfc5eaa-goog

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[David Heidelberg]

Hello Kuen-Han,

sadly this series is not enough to fully fix the usb issue encountered 
on qcom sdm845 platform (namely Pixel 3, OnePlus 6/6T etc.).

I didn't debugged deeply, but without these patches interface (indicated 
by NM icon) goes on/off/on/off indefinitely. With your patches it seems 
stable, but I'm not getting the DHCP address from the phone, which isn't 
issue at all when I revert the 56a512a9b4107079f68701e7d55da8507eb963d9
("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind").

I think reverting the original patch would make more sense and then 
follow up with new one.

Feel free to add me into CC and I'll happily test on the sdm845 mobile 
devices for you.

David

On 21/02/2026 15:48, Kuen-Han Tsai wrote:
> Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
> with bind/unbind") addressed a lifetime mismatch where the network
> interface outlived the parent gadget. However, this introduced two
> regressions:
> 
> 1. A NULL pointer dereference in the legacy g_ncm driver. The legacy
>     driver attempts to access the net_device during its binding process
>     before the NCM function driver is fully initialized.
> 
> 2. A "sleeping function called from atomic context" error in f_ncm.
>     The current implementation holds a mutex which might sleep within
>     an atomic context.
> 
> To resolve these, store the configuration parameters (qmult, host_addr,
> dev_addr) in opts_net until the network device is ready for g_ncm.
> Additionally, remove the net_device pointer from the f_ncm_opts
> structure. This eliminates the race condition with configfs and allows
> dropping the mutex, preventing the atomic sleep issue.
> 
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> Changes in v2:
> - Remove the RFC tag.
> - Fix NPE in gncm reported by the kernel test bot.
> - Fix a "sleeping function called from atomic context" error.
> - Link to v1: https://lore.kernel.org/r/20260214-legacy-ncm-v1-1-139c5bcc6636@google.com
> 
> ---
> Kuen-Han Tsai (2):
>        usb: legacy: ncm: Fix NPE in gncm_bind
>        usb: gadget: f_ncm: Fix atomic context locking issue
> 
>   drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
>   drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
>   drivers/usb/gadget/function/u_ncm.h            |  1 -
>   drivers/usb/gadget/legacy/ncm.c                | 13 +++++++++---
>   4 files changed, 23 insertions(+), 31 deletions(-)
> ---
> base-commit: da87d45b195148d670ab995367d52aa9e8a9a1fa
> change-id: 20260214-legacy-ncm-8c001295b343
> 
> Best regards,

-- 
David Heidelberg

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[Kuen-Han Tsai]

Hi David, Greg,

Thanks for testing. I'm sorry the patches are causing trouble on your setup.

On Sun, Mar 1, 2026 at 5:03 AM David Heidelberg <david@ixit.cz> wrote:
>
> Hello Kuen-Han,
>
> sadly this series is not enough to fully fix the usb issue encountered
> on qcom sdm845 platform (namely Pixel 3, OnePlus 6/6T etc.).
>
> I didn't debugged deeply, but without these patches interface (indicated
> by NM icon) goes on/off/on/off indefinitely. With your patches it seems
> stable, but I'm not getting the DHCP address from the phone, which isn't
> issue at all when I revert the 56a512a9b4107079f68701e7d55da8507eb963d9
> ("usb: gadget: f_ncm: align net_device lifecycle with bind/unbind").
>
> I think reverting the original patch would make more sense and then
> follow up with new one.

The net_device lifecycle change puts us in a dilemma:

1. If we revert the original patch entirely, the NULL pointer
dereference and dangling sysfs references come back on Android.

2. If we only clear the parent gadget pointer during unbind without
unregistering the net_device, the sysfs entries still dangle.

3. If we clear the pointer and unregister the net_device without
freeing it, the device cannot be re-registered unless it is
uninitialized.

4. If we fully unregister and recreate the net_device on each bind, it
breaks DHCP on your setup.

Greg, do you have any thoughts on the best way to untangle this? I am
fully willing to submit a revert for this series to restore the
expected behavior while we figure out a proper architectural fix.

>
> Feel free to add me into CC and I'll happily test on the sdm845 mobile
> devices for you.
>
> David

David, could you share exactly what OS you are using (e.g.,
postmarketOS with an sdm845/6.18-dev tree)? Also, could you provide
some instructions on how to build the code and reproduce this problem
on a Pixel 3? If you have the time, it would be incredibly helpful if
you could dive into this a bit deeper on your device to see exactly
how the DHCP daemon is failing.

Regards,
Kuen-Han


>
> On 21/02/2026 15:48, Kuen-Han Tsai wrote:
> > Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
> > with bind/unbind") addressed a lifetime mismatch where the network
> > interface outlived the parent gadget. However, this introduced two
> > regressions:
> >
> > 1. A NULL pointer dereference in the legacy g_ncm driver. The legacy
> >     driver attempts to access the net_device during its binding process
> >     before the NCM function driver is fully initialized.
> >
> > 2. A "sleeping function called from atomic context" error in f_ncm.
> >     The current implementation holds a mutex which might sleep within
> >     an atomic context.
> >
> > To resolve these, store the configuration parameters (qmult, host_addr,
> > dev_addr) in opts_net until the network device is ready for g_ncm.
> > Additionally, remove the net_device pointer from the f_ncm_opts
> > structure. This eliminates the race condition with configfs and allows
> > dropping the mutex, preventing the atomic sleep issue.
> >
> > Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> > ---
> > Changes in v2:
> > - Remove the RFC tag.
> > - Fix NPE in gncm reported by the kernel test bot.
> > - Fix a "sleeping function called from atomic context" error.
> > - Link to v1: https://lore.kernel.org/r/20260214-legacy-ncm-v1-1-139c5bcc6636@google.com
> >
> > ---
> > Kuen-Han Tsai (2):
> >        usb: legacy: ncm: Fix NPE in gncm_bind
> >        usb: gadget: f_ncm: Fix atomic context locking issue
> >
> >   drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
> >   drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
> >   drivers/usb/gadget/function/u_ncm.h            |  1 -
> >   drivers/usb/gadget/legacy/ncm.c                | 13 +++++++++---
> >   4 files changed, 23 insertions(+), 31 deletions(-)
> > ---
> > base-commit: da87d45b195148d670ab995367d52aa9e8a9a1fa
> > change-id: 20260214-legacy-ncm-8c001295b343
> >
> > Best regards,
>
> --
> David Heidelberg
>

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[Greg Kroah-Hartman]

On Mon, Mar 02, 2026 at 06:15:19PM +0800, Kuen-Han Tsai wrote:
> Greg, do you have any thoughts on the best way to untangle this? I am
> fully willing to submit a revert for this series to restore the
> expected behavior while we figure out a proper architectural fix.

Please submit a revert so we can take the time to untangle this.

thanks,

greg k-h

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[David Heidelberg]

On 02/03/2026 11:15, Kuen-Han Tsai wrote:
[...]>
> David, could you share exactly what OS you are using (e.g.,
> postmarketOS with an sdm845/6.18-dev tree)? Also, could you provide
> some instructions on how to build the code and reproduce this problem
> on a Pixel 3? If you have the time, it would be incredibly helpful if
> you could dive into this a bit deeper on your device to see exactly
> how the DHCP daemon is failing.

Hello Kuen-Han,

it's pmOS initrd, but generally I got reported same behaviour on Mobian (Mobile 
Debian) too.

The Pixel 3 support was merged, so it can be reproduced with:
1. 7.0-rc1 tag
2. -next tree (latest tested is next-20260227)
3. our sdm845-next tree [1] (some WIP patches, working touchscreen on Pixel 3, 
etc.), the tree currently contains the reverts

I can provide log with the patch [2], without the patch [3] (well, it's more 
like nothing is in the log)

I'm very lightly familiar with usb subsystem, so if you give me hints what to 
look for (or what to debug), I'll try find a moment to check to move this forward.

Thank you for working on improving usb gadgets!
David

[1] https://codeberg.org/sdm845/linux/
[2] https://paste.sr.ht/~okias/35982d7e284ee0f767e57923ced591beb4d3b238#L589
[3] https://paste.sr.ht/~okias/4e9172a34e4093445536b51e935dbd229edad7b2#L613


> 
> Regards,
> Kuen-Han
> 
> 
>>
>> On 21/02/2026 15:48, Kuen-Han Tsai wrote:
>>> Commit 56a512a9b410 ("usb: gadget: f_ncm: align net_device lifecycle
>>> with bind/unbind") addressed a lifetime mismatch where the network
>>> interface outlived the parent gadget. However, this introduced two
>>> regressions:
>>>
>>> 1. A NULL pointer dereference in the legacy g_ncm driver. The legacy
>>>      driver attempts to access the net_device during its binding process
>>>      before the NCM function driver is fully initialized.
>>>
>>> 2. A "sleeping function called from atomic context" error in f_ncm.
>>>      The current implementation holds a mutex which might sleep within
>>>      an atomic context.
>>>
>>> To resolve these, store the configuration parameters (qmult, host_addr,
>>> dev_addr) in opts_net until the network device is ready for g_ncm.
>>> Additionally, remove the net_device pointer from the f_ncm_opts
>>> structure. This eliminates the race condition with configfs and allows
>>> dropping the mutex, preventing the atomic sleep issue.
>>>
>>> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
>>> ---
>>> Changes in v2:
>>> - Remove the RFC tag.
>>> - Fix NPE in gncm reported by the kernel test bot.
>>> - Fix a "sleeping function called from atomic context" error.
>>> - Link to v1: https://lore.kernel.org/r/20260214-legacy-ncm-v1-1-139c5bcc6636@google.com
>>>
>>> ---
>>> Kuen-Han Tsai (2):
>>>         usb: legacy: ncm: Fix NPE in gncm_bind
>>>         usb: gadget: f_ncm: Fix atomic context locking issue
>>>
>>>    drivers/usb/gadget/function/f_ncm.c            | 29 +++++++++++---------------
>>>    drivers/usb/gadget/function/u_ether_configfs.h | 11 +---------
>>>    drivers/usb/gadget/function/u_ncm.h            |  1 -
>>>    drivers/usb/gadget/legacy/ncm.c                | 13 +++++++++---
>>>    4 files changed, 23 insertions(+), 31 deletions(-)
>>> ---
>>> base-commit: da87d45b195148d670ab995367d52aa9e8a9a1fa
>>> change-id: 20260214-legacy-ncm-8c001295b343
>>>
>>> Best regards,
>>
>> --
>> David Heidelberg
>>

-- 
David Heidelberg

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[David Heidelberg]

On 02/03/2026 16:41, David Heidelberg wrote:
> On 02/03/2026 11:15, Kuen-Han Tsai wrote:
> [...]>
>> David, could you share exactly what OS you are using (e.g.,
>> postmarketOS with an sdm845/6.18-dev tree)? Also, could you provide
>> some instructions on how to build the code and reproduce this problem
>> on a Pixel 3? If you have the time, it would be incredibly helpful if
>> you could dive into this a bit deeper on your device to see exactly
>> how the DHCP daemon is failing.
> 
> Hello Kuen-Han,
> 
> it's pmOS initrd, but generally I got reported same behaviour on Mobian (Mobile 
> Debian) too.
> 
> The Pixel 3 support was merged, so it can be reproduced with:
> 1. 7.0-rc1 tag
> 2. -next tree (latest tested is next-20260227)
> 3. our sdm845-next tree [1] (some WIP patches, working touchscreen on Pixel 3, 
> etc.), the tree currently contains the reverts

I forgot to mention, the build is just (considering option 3., which includes 
sdm845.config fragment):

make defconfig sdm845.config
make
mkbootimg (with params seen below)

deviceinfo_flash_offset_base="0x00000000"
deviceinfo_flash_offset_kernel="0x00008000"
deviceinfo_flash_offset_ramdisk="0x01000000"
deviceinfo_flash_offset_second="0x00000000"
deviceinfo_flash_offset_tags="0x00000100"

You can use Luca's [1] scripts for the processing kernel to be suitable for 
fastboot (appends initrd to boot.img) and uploading kernel modules to pmOS rootfs.

Options 1. and 2. won't work directly with fastboot, as chainloaded u-boot is 
needed due to fastboot requiring some ancient kernel offset to be in place (we 
keep patch to workaround it in sdm845-next).

David

[1] https://github.com/z3ntu/linux-mainline-scripts/

> 
> I can provide log with the patch [2], without the patch [3] (well, it's more 
> like nothing is in the log)
> 
> I'm very lightly familiar with usb subsystem, so if you give me hints what to 
> look for (or what to debug), I'll try find a moment to check to move this forward.
> 
> Thank you for working on improving usb gadgets!
> David
> 
> [1] https://codeberg.org/sdm845/linux/
> [2] https://paste.sr.ht/~okias/35982d7e284ee0f767e57923ced591beb4d3b238#L589
> [3] https://paste.sr.ht/~okias/4e9172a34e4093445536b51e935dbd229edad7b2#L613

[...]

Re: [PATCH v2 0/2] usb: gadget: Fix g_ncm regression and atomic sleep in f_ncm

[Kuen-Han Tsai]

On Tue, Mar 3, 2026 at 1:22 AM David Heidelberg <david@ixit.cz> wrote:
>
> On 02/03/2026 16:41, David Heidelberg wrote:
> > On 02/03/2026 11:15, Kuen-Han Tsai wrote:
> > [...]>
> >> David, could you share exactly what OS you are using (e.g.,
> >> postmarketOS with an sdm845/6.18-dev tree)? Also, could you provide
> >> some instructions on how to build the code and reproduce this problem
> >> on a Pixel 3? If you have the time, it would be incredibly helpful if
> >> you could dive into this a bit deeper on your device to see exactly
> >> how the DHCP daemon is failing.
> >
> > Hello Kuen-Han,
> >
> > it's pmOS initrd, but generally I got reported same behaviour on Mobian (Mobile
> > Debian) too.
> >
> > The Pixel 3 support was merged, so it can be reproduced with:
> > 1. 7.0-rc1 tag
> > 2. -next tree (latest tested is next-20260227)
> > 3. our sdm845-next tree [1] (some WIP patches, working touchscreen on Pixel 3,
> > etc.), the tree currently contains the reverts
>
> I forgot to mention, the build is just (considering option 3., which includes
> sdm845.config fragment):
>
> make defconfig sdm845.config
> make
> mkbootimg (with params seen below)
>
> deviceinfo_flash_offset_base="0x00000000"
> deviceinfo_flash_offset_kernel="0x00008000"
> deviceinfo_flash_offset_ramdisk="0x01000000"
> deviceinfo_flash_offset_second="0x00000000"
> deviceinfo_flash_offset_tags="0x00000100"
>
> You can use Luca's [1] scripts for the processing kernel to be suitable for
> fastboot (appends initrd to boot.img) and uploading kernel modules to pmOS rootfs.
>
> Options 1. and 2. won't work directly with fastboot, as chainloaded u-boot is
> needed due to fastboot requiring some ancient kernel offset to be in place (we
> keep patch to workaround it in sdm845-next).
>
> David
>
> [1] https://github.com/z3ntu/linux-mainline-scripts/
>
> >
> > I can provide log with the patch [2], without the patch [3] (well, it's more
> > like nothing is in the log)
> >
> > I'm very lightly familiar with usb subsystem, so if you give me hints what to
> > look for (or what to debug), I'll try find a moment to check to move this forward.
> >
> > Thank you for working on improving usb gadgets!
> > David
> >
> > [1] https://codeberg.org/sdm845/linux/
> > [2] https://paste.sr.ht/~okias/35982d7e284ee0f767e57923ced591beb4d3b238#L589
> > [3] https://paste.sr.ht/~okias/4e9172a34e4093445536b51e935dbd229edad7b2#L613
>
> [...]

Hi David,

Thanks for providing the detailed reproduction steps and logs; they
were incredibly helpful. I was able to reproduce the issue locally.

Looking at the failure logs, the regression's cause is the kernel
returning the name pattern "usb%d" via configfs instead of the
interface name "usb0". The pmOS DHCP daemon [1] relies on this string
to bind to the interface. I confirmed that providing the actual
interface name resolves the DHCP server startup failure.

However, investigating a fix revealed a deeper architectural flaw in
my patch. By deferring the net_device allocation to the bind() phase,
a single function instance will spawn multiple network devices if it
is symlinked to multiple USB configurations. Since configfs only
exposes a single ifname attribute per instance, it is fundamentally
impossible to accurately report the interface name when multiple
underlying network devices exist for that single instance.

All configurations tied to the same function instance are meant to
share a single network device, which is why the original design
correctly allocated it at the instance level. Because my approach
breaks this 1:1 mapping, I will send out a revert series in the next
few days.

Thanks again for catching this and helping track it down!

Regards,
Kuen-Han

[1] https://gitlab.com/postmarketOS/pmaports/-/blob/master/main/postmarketos-initramfs/init_functions.sh?ref_type=heads#L771