1 files changed, 26 insertions, 10 deletions

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 5a2e1237f85c..34d9f49e9987 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1222,12 +1222,19 @@ static void usbg_submit_cmd(struct usbg_cmd *cmd)
 	se_cmd = &cmd->se_cmd;
 	tpg = cmd->fu->tpg;
 	tv_nexus = tpg->tpg_nexus;
+	if (!tv_nexus) {
+		struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
+
+		dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
+		return;
+	}
+
 	dir = get_cmd_dir(cmd->cmd_buf);
 	if (dir < 0)
 		goto out;
 
 	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess, cmd->cmd_buf,
-			  cmd->sense_iu.sense, cmd->unpacked_lun, 0,
+			  cmd->sense_iu.sense, cmd->unpacked_lun, cmd->data_len,
 			  cmd->prio_attr, dir, flags);
 
 	return;
@@ -1389,6 +1396,7 @@ static int usbg_submit_command(struct f_uas *fu, struct usb_request *req)
 	cmd->tmr_func = 0;
 	cmd->tmr_rsp = RC_RESPONSE_UNKNOWN;
 	cmd->flags = 0;
+	cmd->data_len = 0;
 
 	cmd_iu = (struct command_iu *)iu;
 
@@ -1482,6 +1490,13 @@ static void bot_cmd_work(struct work_struct *work)
 	se_cmd = &cmd->se_cmd;
 	tpg = cmd->fu->tpg;
 	tv_nexus = tpg->tpg_nexus;
+	if (!tv_nexus) {
+		struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
+
+		dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
+		return;
+	}
+
 	dir = get_cmd_dir(cmd->cmd_buf);
 	if (dir < 0)
 		goto out;
@@ -1641,14 +1656,14 @@ static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
 	struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
 			tport_wwn);
 	struct usbg_tpg *tpg;
-	unsigned long tpgt;
+	u16 tpgt;
 	int ret;
 	struct f_tcm_opts *opts;
 	unsigned i;
 
 	if (strstr(name, "tpgt_") != name)
 		return ERR_PTR(-EINVAL);
-	if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
+	if (kstrtou16(name + 5, 0, &tpgt))
 		return ERR_PTR(-EINVAL);
 	ret = -ENODEV;
 	mutex_lock(&tpg_instances_lock);
@@ -1675,7 +1690,7 @@ static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
 			goto unlock_dep;
 	}
 
-	tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
+	tpg = kzalloc_obj(struct usbg_tpg);
 	ret = -ENOMEM;
 	if (!tpg)
 		goto unref_dep;
@@ -1767,7 +1782,7 @@ static struct se_wwn *usbg_make_tport(
 	if (!wnn_name)
 		return ERR_PTR(-EINVAL);
 
-	tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
+	tport = kzalloc_obj(struct usbg_tport);
 	if (!(tport))
 		return ERR_PTR(-ENOMEM);
 
@@ -1860,7 +1875,7 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
 		goto out_unlock;
 	}
 
-	tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
+	tv_nexus = kzalloc_obj(*tv_nexus);
 	if (!tv_nexus) {
 		ret = -ENOMEM;
 		goto out_unlock;
@@ -2015,6 +2030,7 @@ static const struct target_core_fabric_ops usbg_ops = {
 	.tfc_wwn_attrs			= usbg_wwn_attrs,
 	.tfc_tpg_base_attrs		= usbg_base_attrs,
 
+	.default_compl_type		= TARGET_QUEUE_COMPL,
 	.default_submit_type		= TARGET_DIRECT_SUBMIT,
 	.direct_submit_supp		= 1,
 };
@@ -2399,7 +2415,7 @@ static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 	if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
 		struct guas_setup_wq *work;
 
-		work = kmalloc(sizeof(*work), GFP_ATOMIC);
+		work = kmalloc_obj(*work, GFP_ATOMIC);
 		if (!work)
 			return -ENOMEM;
 		INIT_WORK(&work->work, tcm_delayed_set_alt);
@@ -2446,7 +2462,7 @@ static void tcm_attr_release(struct config_item *item)
 	usb_put_function_instance(&opts->func_inst);
 }
 
-static struct configfs_item_operations tcm_item_ops = {
+static const struct configfs_item_operations tcm_item_ops = {
 	.release		= tcm_attr_release,
 };
 
@@ -2534,7 +2550,7 @@ static struct usb_function_instance *tcm_alloc_inst(void)
 	int i;
 
 
-	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+	opts = kzalloc_obj(*opts);
 	if (!opts)
 		return ERR_PTR(-ENOMEM);
 
@@ -2589,7 +2605,7 @@ static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
 		return ERR_PTR(-ENODEV);
 	}
 
-	fu = kzalloc(sizeof(*fu), GFP_KERNEL);
+	fu = kzalloc_obj(*fu);
 	if (!fu) {
 		mutex_unlock(&tpg_instances_lock);
 		return ERR_PTR(-ENOMEM);