diff options
| author | Hyungjung Joo <jhj140711@gmail.com> | 2026-09-22 00:26:00 +0200 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2026-09-22 08:11:45 +0000 |
| commit | a478958f4c1181ff3362f8857b489c2d069f9c7d (patch) | |
| tree | d3a2761c0439e43a7fc7dff31a0467d906127016 /scripts/basic/split-include.c | |
| parent | bbdb38b2e543ffa72dca5450f2535cf998ef1cdd (diff) | |
| download | linux-a478958f4c1181ff3362f8857b489c2d069f9c7d.tar.gz linux-a478958f4c1181ff3362f8857b489c2d069f9c7d.zip | |
net/9p/usbg: clear stale client pointer on close
p9_usbg_close() tears down the client transport, but usb9pfs keeps
using usb9pfs->client from asynchronous TX and RX completion handlers.
A late completion can therefore dereference a client that has already
been freed during mount teardown.
Clear usb9pfs->client under usb9pfs->lock when closing the transport,
detach any pending TX request from in_req->context, and make the TX/RX
completion handlers bail out once the transport has been detached. This
keeps late completions from touching a freed or rebound p9_client.
Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Cc: stable@vger.kernel.org
Signed-off-by: Hyungjung Joo <jhj140711@gmail.com>
Signed-off-by: Michael Grzeschik <mgr@kernel.org>
Message-ID: <20260922-usb9pfsfixes-v1-7-9d8dcc52904c@kernel.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions