Shuangpeng Bai c39d0916da usb: gadget: f_tcm: keep port count until LUN teardown completes ... tcm_usbg_drop_nexus() permits session removal once tpg_port_count reaches zero. However, usbg_port_unlink() currently decrements that count from the fabric_pre_unlink() callback, before core_dev_del_lun() waits for active se_lun references to drain. If removal of the last LUN races a nexus removal, the latter can observe a zero port count and call target_remove_session(). This frees sess_cmd_map while an in-flight struct usbg_cmd, including its work item, can still be accessed. Overlapping the last-LUN unlink with nexus removal reproduces this lifetime violation as a DEBUG_OBJECTS "free active" warning for usbg_cmd_work, followed by a target-core BUG/Oops. The generic target-core unlink path has no callback after core_dev_del_lun() completes. Add an optional fabric_post_unlink() callback and use it for the f_tcm port count. The count now remains nonzero until core_dev_del_lun() has finished draining active LUN references, preventing nexus removal from freeing the session during command completion. Fixes: c52661d60f ("usb-gadget: Initial merge of target module for UASP + BOT") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Link: https://patch.msgid.link/20260807060733.3186624-1-shuangpeng.kernel@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-08-14 10:49:21 +09:00
..
iscsi	scsi: target: iscsi: switch to using the crc32c library	2024-12-01 17:23:02 -08:00
target_core_backend.h	scsi: target: Add helper to set up atomic values from block_device	2025-11-02 21:40:01 -05:00
target_core_base.h	scsi: core: target: Add INQUIRY-related constants to scsi_common.h	2026-05-22 21:49:04 -04:00
target_core_fabric.h	usb: gadget: f_tcm: keep port count until LUN teardown completes	2026-08-14 10:49:21 +09:00