From cd1988cf723c2eae87112b198bf90b0aebfeaf31 Mon Sep 17 00:00:00 2001 From: Michael Grzeschik Date: Tue, 22 Sep 2026 00:25:57 +0200 Subject: [PATCH] net/9p/usbg: call disable_usb9pfs() from usb9pfs_disable() usb9pfs_disable() is the usb_function ->disable callback, invoked by the composite gadget core whenever the host resets or unconfigures the gadget. The gadget function API requires this callback to disable its endpoints; every other in-tree function driver does so from its ->disable hook. usb9pfs_disable() never called disable_usb9pfs(), so the IN/OUT endpoints and their usb_request objects were left active and allocated across a host-driven disable. When the host later reconfigures the device, enable_usb9pfs() calls alloc_requests() again and unconditionally overwrites usb9pfs->in_req/out_req, permanently leaking the previous allocations, while the endpoints themselves are left enabled underneath the function's own idea of being disabled. Call disable_usb9pfs() before reinit_completion(&usb9pfs->send), mirroring the same sequence already used in p9_usbg_close(). Placing it before the reinit_completion() also ensures usb_ep_disable() has synchronously flushed any requests still queued in hardware before the completion is reset, closing the same race that motivated resetting the completion here in the first place. Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport") Assisted-by: Claude:claude-opus-4.8 Cc: stable@vger.kernel.org Signed-off-by: Michael Grzeschik Message-ID: <20260922-usb9pfsfixes-v1-4-9d8dcc52904c@kernel.org> Signed-off-by: Dominique Martinet --- net/9p/trans_usbg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_usbg.c b/net/9p/trans_usbg.c index 3304986cf136..a214d0b6d875 100644 --- a/net/9p/trans_usbg.c +++ b/net/9p/trans_usbg.c @@ -765,6 +765,10 @@ static void usb9pfs_disable(struct usb_function *f) usb9pfs->client->status = Disconnected; spin_unlock_irqrestore(&usb9pfs->lock, flags); usb9pfs_clear_tx(usb9pfs); + + if (usb9pfs->in_ep->enabled) + disable_usb9pfs(usb9pfs); + reinit_completion(&usb9pfs->send); }