Netdev List
 help / color / mirror / Atom feed
From: Potin Lai <potin.lai.pt@gmail.com>
To: Andrew Lunn <andrew+netdev@lunn.ch>,
	 "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	 Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,
	 Oliver Neukum <oliver@neukum.org>,
	 Samuel Mendoza-Jonas <sam@mendozajonas.com>,
	 Paul Fertser <fercerpav@gmail.com>,
	Simon Horman <horms@kernel.org>
Cc: linux-usb@vger.kernel.org, netdev@vger.kernel.org,
	 linux-kernel@vger.kernel.org,
	Cosmo Chou <cosmo.chou@quantatw.com>,
	 Mike Hsieh <Mike_Hsieh@quantatw.com>,
	Mik Lin <Mik.Lin@quantatw.com>,
	 Potin Lai <potin.lai@quantatw.com>,
	Potin Lai <potin.lai.pt@gmail.com>,
	 Adrian Ambrozewicz <aambrozewicz@nvidia.com>
Subject: [PATCH 0/2] net: add USB CDC Ethernet NCSI support and fix unregister UAF
Date: Mon, 07 Sep 2026 20:15:54 +0800	[thread overview]
Message-ID: <20260907-ncsi-over-usb-v1-0-6b74d2f1196c@gmail.com> (raw)

This series introduces NCSI (Network Controller Sideband Interface)
passthrough support for USB CDC Ethernet devices and fixes a
use-after-free race condition in the NCSI core unregistration path.

In DPU (Data Processing Unit) platforms such as the NVIDIA BlueField
series, the Baseboard Management Controller (BMC) communicates with the
host or DPU via a dedicated USB CDC Ethernet connection for out-of-band
management traffic.

Unlike traditional platform Ethernet devices where NCSI is initialized
statically at probe time, USB devices require dynamic lifecycle
management within ndo_open() and ndo_stop():

1. NCSI control packets share the USB data path, requiring the link
   carrier to remain enabled while the interface is up.
2. In USB drivers, usbnet_disconnect() invokes unregister_netdev()
   before unbind(). Performing NCSI registration in ndo_open() and
   cleanup in ndo_stop() ensures NCSI packet handlers are removed before
   netdevice teardown occurs.
3. Dynamic unregistration of NCSI devices revealed a race in the NCSI
   core: ncsi_unregister_dev() freed the ncsi_dev_priv structure while
   asynchronous request timers and workqueue items were still active.

Signed-off-by: Potin Lai <potin.lai.pt@gmail.com>
---
Adrian Ambrozewicz (2):
      net: usb: cdc_ether: add NCSI passthrough support
      net/ncsi: fix use-after-free in ncsi_unregister_dev()

 drivers/net/usb/Kconfig     |  20 +++++
 drivers/net/usb/cdc_ether.c | 190 +++++++++++++++++++++++++++++++++++++++++++-
 net/ncsi/ncsi-manage.c      |  19 +++++
 3 files changed, 228 insertions(+), 1 deletion(-)
---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260907-ncsi-over-usb-3e786f4686c8

Best regards,
--  
Potin Lai <potin.lai.pt@gmail.com>


             reply	other threads:[~2026-09-07 12:18 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-07 12:15 Potin Lai [this message]
2026-09-07 12:15 ` [PATCH 1/2] net: usb: cdc_ether: add NCSI passthrough support Potin Lai
2026-09-07 18:17   ` Andrew Lunn
2026-09-08 12:45     ` Potin Lai
2026-09-08 13:54       ` Andrew Lunn
2026-09-07 12:15 ` [PATCH 2/2] net/ncsi: fix use-after-free in ncsi_unregister_dev() Potin Lai
2026-09-07 18:23 ` [PATCH 0/2] net: add USB CDC Ethernet NCSI support and fix unregister UAF Andrew Lunn
2026-09-08 12:33   ` Potin Lai
2026-09-09 18:42     ` Andrew Lunn

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260907-ncsi-over-usb-v1-0-6b74d2f1196c@gmail.com \
    --to=potin.lai.pt@gmail.com \
    --cc=Mik.Lin@quantatw.com \
    --cc=Mike_Hsieh@quantatw.com \
    --cc=aambrozewicz@nvidia.com \
    --cc=andrew+netdev@lunn.ch \
    --cc=cosmo.chou@quantatw.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=fercerpav@gmail.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=oliver@neukum.org \
    --cc=pabeni@redhat.com \
    --cc=potin.lai@quantatw.com \
    --cc=sam@mendozajonas.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox