[PATCH v2 0/2] net: add USB CDC Ethernet NCSI support and fix unregister UAF
From: Potin Lai <hidden>
Date: 2026-09-08 13:04:09
Also in:
linux-usb, lkml
This series introduces NCSI (Network Controller Sideband Interface) passthrough support for USB CDC Ethernet devices and fixes a use-after-free race condition in the NCSI core unregistration path. In DPU (Data Processing Unit) platforms such as the NVIDIA BlueField series, the Baseboard Management Controller (BMC) communicates with the host or DPU via a dedicated USB CDC Ethernet connection for out-of-band management traffic. Unlike traditional platform Ethernet devices where NCSI is initialized statically at probe time, USB devices require dynamic lifecycle management within ndo_open() and ndo_stop(): 1. NCSI control packets share the USB data path, requiring the link carrier to remain enabled while the interface is up. 2. In USB drivers, usbnet_disconnect() invokes unregister_netdev() before unbind(). Performing NCSI registration in ndo_open() and cleanup in ndo_stop() ensures NCSI packet handlers are removed before netdevice teardown occurs. 3. Dynamic unregistration of NCSI devices revealed a race in the NCSI core: ncsi_unregister_dev() freed the ncsi_dev_priv structure while asynchronous request timers and workqueue items were still active. Signed-off-by: Potin Lai <redacted> --- Changes in v2: - Rearrange cdc_ncsi_open() and cdc_ncsi_stop() to avoid forward declarations. - Use timer_delete_sync() instead of del_timer_sync() to fix build errors on newer kernels. - Link to v1: https://patch.msgid.link/20260907-ncsi-over-usb-v1-0-6b74d2f1196c@gmail.com To: Andrew Lunn <andrew+netdev@lunn.ch> To: "David S. Miller" <davem@davemloft.net> To: Eric Dumazet <edumazet@google.com> To: Jakub Kicinski <kuba@kernel.org> To: Paolo Abeni <pabeni@redhat.com> To: Oliver Neukum <oliver@neukum.org> To: Samuel Mendoza-Jonas <sam@mendozajonas.com> To: Paul Fertser <fercerpav@gmail.com> To: Simon Horman <horms@kernel.org> Cc: linux-usb@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Cosmo Chou <cosmo.chou@quantatw.com> Cc: Mike Hsieh <redacted> Cc: Mik Lin <redacted> Cc: Potin Lai <redacted> --- Adrian Ambrozewicz (2): net: usb: cdc_ether: add NCSI passthrough support net/ncsi: fix use-after-free in ncsi_unregister_dev() drivers/net/usb/Kconfig | 20 +++++ drivers/net/usb/cdc_ether.c | 187 +++++++++++++++++++++++++++++++++++++++++++- net/ncsi/ncsi-manage.c | 19 +++++ 3 files changed, 225 insertions(+), 1 deletion(-) --- base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f change-id: 20260907-ncsi-over-usb-3e786f4686c8 Best regards, -- Potin Lai [off-list ref]