diff options
| author | Thinh Nguyen <Thinh.Nguyen@synopsys.com> | 2024-12-11 00:31:36 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-24 08:56:05 +0100 |
| commit | c225d006a31949d673e646d585d9569bc28feeb9 (patch) | |
| tree | 48d18643eb2e43f4c35aa6cfefc5ccdb3049fa72 /drivers/usb/gadget | |
| parent | 1aede069816747609d45f02947440a8ad0c3490f (diff) | |
| download | linux-stable-c225d006a31949d673e646d585d9569bc28feeb9.tar.gz linux-stable-c225d006a31949d673e646d585d9569bc28feeb9.tar.bz2 linux-stable-c225d006a31949d673e646d585d9569bc28feeb9.zip | |
usb: gadget: f_tcm: Don't free command immediately
Don't prematurely free the command. Wait for the status completion of
the sense status. It can be freed then. Otherwise we will double-free
the command.
Fixes: cff834c16d23 ("usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/ae919ac431f16275e05ec819bdffb3ac5f44cbe1.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/function/f_tcm.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index e1914b20f816..6313302a5b96 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1062,7 +1062,6 @@ static void usbg_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, @@ -1191,7 +1190,6 @@ static void bot_cmd_work(struct work_struct *work) out: transport_send_check_condition_and_sense(se_cmd, TCM_UNSUPPORTED_SCSI_OPCODE, 1); - transport_generic_free_cmd(&cmd->se_cmd, 0); } static int bot_submit_command(struct f_uas *fu, |