From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f43.google.com (mail-ot1-f43.google.com [209.85.210.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E2D01EB9E3 for ; Thu, 19 Feb 2026 01:48:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771465689; cv=none; b=tnx1f0BTYDEgZiAHwpL7Xdm8lB4/prBvWdXjH1Z/MjVUU5EfDo8sa7dLEmaZRQWxNxwiVPwyKQTG0WgaPfHMFmCCfRoAPQIUNIKM6pmbtsKkBspA0S56HU+xmtzGjwMQj2juH2cTPHwW0aovGt4Aa/J2KwjYt5Mm43YDam+uoeE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771465689; c=relaxed/simple; bh=nj7llv0SLj8JbUewm5eoLBkK4iyw9xhnNYbkQAre1Vc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=uj9CPF7ht5BxElq7QfzAEzMSOHOOjm1qIrXaAHXe7x9coyHhwEE+N0JFgeA4GTHtexcQ4h2uApeCBhmLJLPM4XC2Dj9WvvsgL4PClhqHwqdDdQ/YZyTsFq4XRMDqEEGFZ3qblcQngthI7arA0YFprTfVldocrpuSgvtaeUH2Pgo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EX3EZaHK; arc=none smtp.client-ip=209.85.210.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EX3EZaHK" Received: by mail-ot1-f43.google.com with SMTP id 46e09a7af769-7d4c65d772cso520222a34.1 for ; Wed, 18 Feb 2026 17:48:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771465685; x=1772070485; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uaJh0fRvDfzQ3zRfXH5p2HojoBn3ZRqWgoRPT9D8ObM=; b=EX3EZaHKdut0/Y7EuGVjWnw8L49BUPoZvob8rwUTls/hl+zep2OszGUyachrMF5dMQ aiWfYoXsc34JNRyGK45mYWShDeKRE2u7BUpBYZmxVjgei/FuxaVl1EGF6sZpkIZ1XRy2 dz7uvEDjAxXUvdz4m9YuggSawlLctWjNcxmWgKpW8CrLn9IKWkEfiFhtVzml9XF/XvoG QFmirXvJbfVH/54yh90YuIauNyi1vRtJHzlHZue94m/QGCZX2fZof1iOtNsEz7NMjpyI oElwEq7BKEJES59WLUW0KbYg/g6yWVqCJqYpTxGNz41pENeLs3uIiZ2z//anW9BWS1GF Ehjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771465685; x=1772070485; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=uaJh0fRvDfzQ3zRfXH5p2HojoBn3ZRqWgoRPT9D8ObM=; b=RvDWSxdHdBLIC6BRq84V6vjlQBetkUXCVyqh63W6wCpgm9rC5PqKOoPUd9XIM/qluB hp76g/6Vn11XYMWbGaHo5JcTVPeeJkFMiiWPFUnk2DozDyjaEx+Qxunn+AYeaCZXDLXT 4uKLcUm93uXiEV3LJuqkDk74WjWQqfQci7O9CIqOqgFG+xTcj55euOnDLYBT6tPGrW+C 0NpXVQUEx219FAJOoqrFAENAZbzxI6SWFiJejjHZCe8fwUVnVcAVpvLVqGJx4UM1tLv+ uW7dJc1BKFhKlBSbUs6ubMuT7Svv8NFG3OZx3sKNmci6uPWE7i7TUMsM4T1dJqrvVhEK Be4Q== X-Forwarded-Encrypted: i=1; AJvYcCVRkTi0UJn4Xtv9ZbzNSdIRZGblexy/cziknB/2grpRs6IrTyyC4x0MnZjGnaXIi9UCjPXxNcCFnJPAcXo=@vger.kernel.org X-Gm-Message-State: AOJu0YzpLCiiR+zctBPYMirDmpes6xCQDxnNCH5qrgDmlCTp1F5KX5J/ 21F4mR98lSfU55vsP1g+/BPtZytMfw1kVENNOqJl8R8XHusFDFMsK/tK X-Gm-Gg: AZuq6aIzVxLRvOSKj8eQiiSRq7hFWh/tmeZqLk6QyOmNxXMh3yJv8EAbY/q5PeVfYCt yS4a7FJFCOL0hCM0b/wTaAS7Elr/EWkoHjHLNpWlc/jcjpjj0dztTgdXX4p5VJJE+aAwNjrZzd8 FMTChThguxhWQEl0h8/Ga58FJSVYS+oahqE9aH/gtQI58rAYUdqgn5/yRgr+1xM6XG+trg015Nc 0Z92PNj8Jk1VTlfGwHM/hzfe3FvvjUF29/YqU7FZWRPKejcGjSVx311Ar21fRO6PO9RQvhAKMK0 VX+Uj6+Di2ho7+ZLSphkMEJtnFr7io65AXj7J28Mv1ZD4zdaBokPBpeTa92z4v6UqQKS75N3bnu s8CesyLekW640Zk9xwnxLR3e05+IfFpLjQOnI2YCBD7rxB1jHIsJWjyJPTAiAnsyMtZhOLrWo7z cPd5gB0i4Tj09pjhbBz0b340Uy/vGadG+4qci7jYqM5Bwm X-Received: by 2002:a05:6830:6ab5:b0:7cf:d119:8d93 with SMTP id 46e09a7af769-7d505ce8c89mr2549804a34.0.1771465685298; Wed, 18 Feb 2026 17:48:05 -0800 (PST) Received: from newman.cs.purdue.edu ([128.10.127.250]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7d4a76f9483sm20591727a34.20.2026.02.18.17.48.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Feb 2026 17:48:04 -0800 (PST) From: Jiasheng Jiang To: thinh.nguyen@synopsys.com Cc: andrzej.p@samsung.com, bigeasy@linutronix.de, chenyufeng@iie.ac.cn, gregkh@linuxfoundation.org, jiashengjiangcool@gmail.com, linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org, nab@linux-iscsi.org Subject: Re: [PATCH] usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling Date: Thu, 19 Feb 2026 01:48:04 +0000 Message-Id: <20260219014804.14705-1-jiashengjiangcool@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260219012929.u6btnnmqvbyujz5f@synopsys.com> References: <20260219012929.u6btnnmqvbyujz5f@synopsys.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Thu, 19 Feb 2026 01:30:16 +0000, Thinh Nguyen wrote: > On Wed, Feb 18, 2026, Sebastian Andrzej Siewior wrote: >> On 2026-02-18 05:22:21 [+0000], Thinh Nguyen wrote: >> > > Fixes: 08a1cb0f65fd ("usb: gadget: tcm: factor out f_tcm") >> > > Signed-off-by: Jiasheng Jiang >> … >> > While the patch itself is fine, we should prevent this situation from >> > occurring in the first place. That is, we should enforce the config >> > dependency and prevent the users from removing the nexus if the gadget >> > driver is bound. Likewise, we should prevent the gadget driver from >> > binding if no nexus is established. >> >> Is this an actual problem or just something that looks like it could >> happen? My memory is that the tcm holds a reference on it and the >> referenced commit just split/moved the code. So if it is a problem then >> it should have been there longer than that. >> > > Looks like we only hold the reference to the session cmds, and we track > the tpg_port_count if there's an established link. But we don't guard or > deactivate the f_tcm usb function when we unregister the tcm and remove > the nexus. As far as the host can tell, the device is still connected > and the function is still active. > > This exists since the beginning. The Fixes tag should have pointed to > c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT") > > We can guard against unlinking the port while the gadget_driver is bound > or we can just deactivate the usb function when that happens. The latter > is probably a better option. > > BR, > Thinh Thanks for the clarification. I understand your point about "The latter" option: we should deactivate the USB function when the nexus is dropped to stop new traffic from the host. However, even if we implement the deactivation logic in tcm_usbg_drop_nexus, there could still be a race condition where pending work items (e.g., bot_cmd_work) are already scheduled but haven't executed yet. Therefore, I believe the if (!tv_nexus) checks in this patch are still necessary as a safeguard to drain pending requests safely without crashing. My Proposal: Can we proceed with this patch (adding the NULL checks and fixing the Fixes tag) to close the immediate panic? The architectural change to deactivate the function could then be handled in a separate follow-up patch, as it might require more extensive testing. Does that sound reasonable to you? Best regards, Jiasheng