Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Shuangpeng Bai c1f359d9a5 usb: gadget: f_tcm: keep port count until LUN teardown completes ... commit c39d0916da upstream. tcm_usbg_drop_nexus() permits session removal once tpg_port_count reaches zero. However, usbg_port_unlink() currently decrements that count from the fabric_pre_unlink() callback, before core_dev_del_lun() waits for active se_lun references to drain. If removal of the last LUN races a nexus removal, the latter can observe a zero port count and call target_remove_session(). This frees sess_cmd_map while an in-flight struct usbg_cmd, including its work item, can still be accessed. Overlapping the last-LUN unlink with nexus removal reproduces this lifetime violation as a DEBUG_OBJECTS "free active" warning for usbg_cmd_work, followed by a target-core BUG/Oops. The generic target-core unlink path has no callback after core_dev_del_lun() completes. Add an optional fabric_post_unlink() callback and use it for the f_tcm port count. The count now remains nonzero until core_dev_del_lun() has finished draining active LUN references, preventing nexus removal from freeing the session during command completion. Fixes: c52661d60f ("usb-gadget: Initial merge of target module for UASP + BOT") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Link: https://patch.msgid.link/20260807060733.3186624-1-shuangpeng.kernel@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-09-02 14:27:28 +02:00
..
accessibility	accessibility: speakup: unregister tty ldisc on later init failures	2026-09-02 14:27:28 +02:00
acpi	ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup	2026-07-24 15:51:56 +02:00
amba	amba: tegra-ahb: Fix device leak on SMMU enable	2026-01-19 13:09:54 +01:00
android	binder: fix UAF in binder_free_transaction()	2026-07-24 15:51:19 +02:00
ata	ata: pata_sl82c105: fix bridge revision use-after-free	2026-08-19 17:14:14 +02:00
atm	atm: fore200e: fix use-after-free in tasklets during device removal	2026-03-04 07:20:36 -05:00
auxdisplay	auxdisplay: arm-charlcd: fix release_mem_region() size	2026-03-04 07:19:20 -05:00
base	Revert "PM: sleep: Use complete() in device_pm_sleep_init()"	2026-09-02 14:27:26 +02:00
bcma	Driver core update for 5.15-rc1	2021-09-01 08:44:42 -07:00
block	null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows	2026-08-27 14:28:18 +02:00
bluetooth	Bluetooth: qca: fix NVM tag length underflow in TLV parser	2026-08-19 17:13:54 +02:00
bus	bus: sunxi-rsb: Always check register address validity	2026-07-24 15:51:30 +02:00
cdrom	cdrom: fix stack out-of-bounds read in CDROMVOLCTRL	2026-08-19 17:14:02 +02:00
char	tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()	2026-08-23 14:17:22 +02:00
clk	clk: qcom: a53: Corrected frequency multiplier for 1152MHz	2026-07-24 15:51:37 +02:00
clocksource	clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF	2026-03-04 07:20:00 -05:00
comedi	comedi: comedi_parport: deal with premature interrupt	2026-08-19 17:14:02 +02:00
connector	net/connector: Add const qualifier to cb_id	2020-12-16 11:06:49 -08:00
counter	counter: microchip-tcb-capture: Fix DT channel validation	2026-08-19 17:14:13 +02:00
cpufreq	cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()	2026-08-19 17:14:11 +02:00
cpuidle	cpuidle: powerpc: avoid double clear when breaking snooze	2026-06-01 17:35:22 +02:00
crypto	crypto: qce - fix error path in devm_qce_register_algs	2026-08-23 14:17:16 +02:00
cxl	cxl/mem: Fix shutdown order	2023-11-20 11:08:27 +01:00
dax	dax/kmem: account for partial discontiguous resource upon removal	2026-07-24 15:51:31 +02:00
dca	dca: Use PTR_ERR_OR_ZERO() to simplify code	2020-05-15 16:25:20 +02:00
devfreq	PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()	2025-08-28 16:24:17 +02:00
dio	drivers: dio: fix possible memory leak in dio_init()	2022-12-31 13:14:27 +01:00
dma	dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK	2026-08-23 14:17:22 +02:00
dma-buf	udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()	2026-08-23 14:17:31 +02:00
edac	EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info	2026-07-24 15:51:31 +02:00
eisa	EISA: use DEVICE_ATTR_RO() helper macro	2021-06-04 15:28:34 +02:00
extcon	extcon: ptn5150: handle pending IRQ events during system resume	2026-06-01 17:35:22 +02:00
firewire	firewire: net: Fix fragmented datagram reassembly	2026-08-19 17:13:56 +02:00
firmware	firmware: stratix10-svc: fix memory leaks and list corruption bugs	2026-08-19 17:14:12 +02:00
fpga	fpga: dfl: fme: add error handling	2026-09-02 14:27:28 +02:00
fsi	use less confusing names for iov_iter direction initializers	2026-06-19 13:33:46 +02:00
gnss	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
gpio	gpio: ml-ioh: use raw_spinlock_t for the register lock	2026-08-27 14:28:19 +02:00
gpu	drm/amdgpu: check ASPM on the dGPU host link	2026-08-27 14:28:20 +02:00
greybus	greybus: Fix use-after-free bug in gb_interface_release due to race condition.	2024-07-05 09:14:23 +02:00
hid	HID: input: read battery capacity from its actual report offset	2026-09-02 14:27:28 +02:00
hsi	HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition	2025-05-02 07:44:06 +02:00
hv	Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs	2026-07-04 13:39:40 +02:00
hwmon	hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination	2026-08-19 17:14:14 +02:00
hwspinlock	hwspinlock: qcom: avoid uninitialized struct members	2026-07-24 15:51:34 +02:00
hwtracing	intel_th: fix MSC output device reference leak	2026-08-19 17:14:02 +02:00
i2c	i2c: iproc: reset bus after timeout if START_BUSY is stuck	2026-08-23 14:17:30 +02:00
i3c	i3c: master: Prevent reuse of dynamic address on device add failure	2026-07-24 15:51:39 +02:00
idle	intel_idle: Allow loading ACPI tables for any family	2025-08-28 16:24:16 +02:00
iio	iio: imu: inv_icm42600: fix timestamp clock period by using lower value	2026-07-24 15:52:02 +02:00
infiniband	RDMA/rxe: Fix OOB in free_rd_atomic_resources()	2026-09-02 14:27:25 +02:00
input	Input: atkbd - skip deactivate for HONOR ZQC-P	2026-08-27 14:28:22 +02:00
interconnect	interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node	2025-08-28 16:24:03 +02:00
iommu	iommu/amd: Don't split flush for amd_iommu_domain_flush_all()	2026-08-23 14:17:17 +02:00
ipack	ipack: ipoctal: fix module reference leak	2021-09-27 17:38:49 +02:00
irqchip	irqchip/crossbar: Use correct index in crossbar_domain_free()	2026-07-24 15:51:50 +02:00
isdn	use less confusing names for iov_iter direction initializers	2026-06-19 13:33:46 +02:00
leds	leds: lm3601x: Improve error reporting for problems during .remove()	2026-07-24 15:52:01 +02:00
macintosh	macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse	2026-01-19 13:09:28 +01:00
mailbox	mailbox: mailbox-test: make data_ready a per-instance variable	2026-06-01 17:35:41 +02:00
mcb	mcb: fix a double free bug in chameleon_parse_gdd()	2025-05-02 07:44:31 +02:00
md	dm-verity: make error counter atomic	2026-08-23 14:17:23 +02:00
media	media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()	2026-08-23 14:17:26 +02:00
memory	memory: tegra30-emc: Fix dll_change check	2026-06-01 17:35:33 +02:00
memstick	memstick: ms_block: reject a card that reports too many blocks	2026-07-24 15:51:55 +02:00
message	scsi: fusion: Remove unused variable 'rc'	2024-12-14 19:51:02 +01:00
mfd	mfd: tps6586x: Fix OF node refcount	2026-07-24 15:51:48 +02:00
misc	misc: fastrpc: Remove buffer from list prior to unmap operation	2026-08-27 14:28:19 +02:00
mmc	mmc: vub300: fix use-after-free on probe failure	2026-08-23 14:17:23 +02:00
most	most: usb: fix double free on late probe failure	2025-12-07 06:09:35 +09:00
mtd	Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"	2026-09-02 14:27:26 +02:00
mux	mux: gpio: Simplify code by using dev_err_probe()	2021-04-02 16:28:53 +02:00
net	can: use skb hash instead of private variable in headroom	2026-08-27 14:28:22 +02:00
nfc	nfc: st21nfca: validate ATR_REQ length against the received frame	2026-08-27 14:28:20 +02:00
ntb	NTB: epf: Make db_valid_mask cover only real doorbell bits	2026-07-24 15:51:40 +02:00
nubus	nubus: Partially revert proc_create_single_data() conversion	2023-07-05 18:25:05 +01:00
nvdimm	nvdimm/btt: Free arena sub-allocations on discover_arenas() error path	2026-07-24 15:51:48 +02:00
nvme	nvmet-tcp: bound SGL data length before allocating command buffers	2026-09-02 14:27:27 +02:00
nvmem	nvmem: core: improve range check for nvmem_cell_write()	2025-03-13 12:50:32 +01:00
of	device property: Make modifications of fwnode "flags" thread safe	2026-06-01 17:35:13 +02:00
opp	OPP: debugfs: Fix warning around icc_get_name()	2024-03-26 18:21:23 -04:00
parisc	parisc: Fix IRQ leak in LASI driver	2026-06-01 17:35:21 +02:00
parport	parport: Fix race between port and client registration	2026-06-19 13:33:26 +02:00
pci	PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems	2026-08-27 14:28:18 +02:00
pcmcia	PCMCIA: Fix garbled log messages for KERN_CONT	2026-06-01 17:35:37 +02:00
perf	perf: arm_spe: Prevent overflow in PERF_IDX2OFF()	2025-10-19 16:21:29 +02:00
phy	phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB	2026-08-19 17:14:11 +02:00
pinctrl	treewide: rename pinctrl_gpio_direction_output_new()	2026-08-23 14:17:24 +02:00
platform	platform/x86: xo15-ebook: Fix wakeup source and GPE handling	2026-07-24 15:51:37 +02:00
pnp	PNP: ACPI: fix fortify warning	2024-02-23 08:54:38 +01:00
power	power: supply: charger-manager: fix refcount leak in is_full_charged()	2026-07-24 15:51:49 +02:00
powercap	powercap: fix sscanf() error return value handling	2026-01-19 13:10:19 +01:00
pps	pps: fix warning in pps_register_cdev when register device fail	2025-10-19 16:21:33 +02:00
ps3	powerpc/ps3: Warn on PS3 device errors	2021-06-10 21:44:58 +10:00
ptp	ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.	2026-02-06 16:41:51 +01:00
pwm	pwm: imx27: Fix variable truncation in .apply()	2026-07-24 15:51:30 +02:00
rapidio	rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()	2026-07-24 15:51:31 +02:00
ras	RAS/CEC: Correct ce_add_elem()'s returned values	2021-04-07 11:52:26 +02:00
regulator	regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()	2026-07-24 15:52:02 +02:00
remoteproc	remoteproc: qcom: Fix leak when custom dump_segments addition fails	2026-08-23 14:17:21 +02:00
reset	reset: sunxi: fix memory region leak on ioremap failure	2026-07-24 15:51:55 +02:00
rpmsg	rpmsg: core: fix race in driver_override_show() and use core helper	2026-03-04 07:20:25 -05:00
rtc	rtc: cmos: unregister HPET IRQ handler on probe failure	2026-07-24 15:51:41 +02:00
s390	s390/vfio_ccw: Free all memory if cp_init() fails	2026-08-27 14:28:22 +02:00
sbus	module: remove never implemented MODULE_SUPPORTED_DEVICE	2021-03-17 13:16:18 -07:00
scsi	scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write	2026-08-23 14:17:29 +02:00
sh	sh: clk: Fix clk_enable() to return 0 on NULL clk	2025-01-09 13:28:34 +01:00
siox	siox: fix possible memory leak in siox_device_add()	2022-11-26 09:24:36 +01:00
slimbus	slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd	2026-07-24 15:51:16 +02:00
soc	soc: fsl: qe: panic on ioremap() failure in qe_reset()	2026-07-24 15:51:47 +02:00
soundwire	soundwire: stream: restore params when prepare ports fail	2025-08-28 16:24:10 +02:00
spi	spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers	2026-08-19 17:14:14 +02:00
spmi	spmi: hisi-spmi-controller: Do not override device identifier	2024-07-05 09:14:20 +02:00
ssb	ssb: Fix division by zero issue in ssb_calc_clock_rate	2024-09-04 13:23:20 +02:00
staging	staging: rtl8723bs: validate monitor transmit frame lengths	2026-08-19 17:14:16 +02:00
target	usb: gadget: f_tcm: keep port count until LUN teardown completes	2026-09-02 14:27:28 +02:00
tc	The main MIPS changes for 5.6:	2020-01-31 11:28:31 -08:00
tee	tee: optee: prevent use-after-free when the client exits before the supplicant	2026-06-19 13:33:32 +02:00
thermal	Revert "thermal/drivers/hwmon: Cleanup coding style a bit"	2026-08-19 17:14:17 +02:00
thunderbolt	thunderbolt: Prevent XDomain delayed work use-after-free on disconnect	2026-08-23 14:17:23 +02:00
tty	serial: amba-pl011: synchronize DMA teardown	2026-08-27 14:28:19 +02:00
uio	uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe	2026-01-19 13:09:23 +01:00
usb	usb: gadget: f_tcm: keep port count until LUN teardown completes	2026-09-02 14:27:28 +02:00
vdpa	VDUSE: avoid leaking information to userspace	2026-08-23 14:17:19 +02:00
vfio	vfio/pci: Release the VGA arbiter client on register_device() failure	2026-07-24 15:51:57 +02:00
vhost	vhost: reset the vring metadata cache on vring reconfiguration	2026-08-19 17:14:17 +02:00
video	fbcon: Use correct type for vc_resize() return value	2026-08-23 14:17:18 +02:00
virt	minmax: add in_range() macro	2025-10-19 16:21:28 +02:00
virtio	virtio-mmio: fix device release warning on module unload	2026-07-24 15:51:20 +02:00
visorbus	visorbus: fix error return code in visorchipset_init()	2021-06-04 15:27:26 +02:00
vlynq	bus: Make remove callback return void	2021-07-21 11:53:42 +02:00
vme	vme: Fix error not catched in fake_init()	2022-12-31 13:14:30 +01:00
w1	w1: therm: Fix off-by-one buffer overflow in alarms_store	2026-02-06 16:42:02 +01:00
watchdog	watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()	2026-08-19 17:13:56 +02:00
xen	scsi: xen: scsiback: Free unsubmitted command instead of double-putting it	2026-07-24 15:51:52 +02:00
zorro	zorro: Drop useless (and hardly used) .driver member in struct zorro_dev	2021-08-05 14:37:04 +02:00
Kconfig	firmware: include drivers/firmware/Kconfig unconditionally	2021-10-07 16:51:26 +02:00
Makefile	virtio: always enter drivers/virtio/	2021-12-22 09:32:39 +01:00