Hi On Sat, Mar 14, 2026 at 02:16:59AM +0900, Hyungjung Joo wrote: >p9_usbg_close() tears down the client transport, but usb9pfs keeps >using usb9pfs->client from asynchronous TX and RX completion handlers. >A late completion can therefore dereference a client that has already >been freed during mount teardown. > >Clear usb9pfs->client under usb9pfs->lock when closing the transport, >detach any pending TX request from in_req->context, and make the TX/RX >completion handlers bail out once the transport has been detached. This >keeps late completions from touching a freed or rebound p9_client. > >Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") >Cc: stable@vger.kernel.org >Reviewed-by: Greg Kroah-Hartman I wonder where greg did this review? Was this in another thread? I will have to drop this anyway, when splitting it appart. >Signed-off-by: Hyungjung Joo >--- > net/9p/trans_usbg.c | 63 +++++++++++++++++++++++++++++++++------------ > 1 file changed, 47 insertions(+), 16 deletions(-) > ... -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |