From: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
commit 3b2a52e88ab0c9469eaadd4d4c8f57d072477820 upstream.
We submitted the command with TARGET_SCF_ACK_KREF, which requires
acknowledgment of command completion. If the command fails, make sure to
decrement the ref count.
Fixes: cff834c16d23 ("usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/3c667b4d9c8b0b580346a69ff53616b6a74cfea2.1733876548.git.Thinh.Nguyen@xxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/usb/gadget/function/f_tcm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -971,6 +971,7 @@ static void usbg_data_write_cmpl(struct
return;
cleanup:
+ target_put_sess_cmd(se_cmd);
transport_generic_free_cmd(&cmd->se_cmd, 0);
}
Patches currently in stable-queue which might be from Thinh.Nguyen@xxxxxxxxxxxx are
queue-5.4/usb-gadget-f_tcm-translate-error-to-sense.patch
queue-5.4/usb-gadget-f_tcm-ep_autoconfig-with-fullspeed-endpoint.patch
queue-5.4/usb-gadget-f_tcm-decrement-command-ref-count-on-cleanup.patch
queue-5.4/usb-gadget-f_tcm-don-t-free-command-immediately.patch
queue-5.4/usb-gadget-f_tcm-don-t-prepare-bot-write-request-twice.patch
