Re: [PATCH 2/3] usb: gadget: f_tcm: detach gadget when dropping an enabled TPG

[sashiko-bot@kernel.org]

> Removing a TPG directory via configfs rmdir ends up in usbg_drop_tpg()
> through target_fabric_tpg_release(). The target core does not disable
> the TPG first, so if the TPG is still enabled and the gadget is bound to
> a UDC, usbg_drop_tpg() destroys the TPG workqueue and frees the TPG
> while the bound function still references it through fu->tpg.
> Subsequent USB traffic (tcm_setup(), bot_submit_command(),
> usbg_submit_command(), ...) then dereferences freed memory and queues
> work onto a destroyed workqueue.
> 
> Disable the TPG through usbg_enable_tpg() before tearing it down, so the
> gadget is unbound in the same way as when writing 0 to the enable
> attribute. Only do so when the gadget is connected: for the legacy
> g_target driver, detaching a never-attached TPG would call
> usb_composite_unregister() on a driver that was never registered.
> 
> Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Slawomir Stepien <sst@poczta.fm>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022134926.1125473-1-sst@poczta.fm?part=2