Re: [BUG] usb: gadget: f_tcm: NULL-ptr-deref / use-after-free when the UDC is disconnected during in-flight target I/O

[Greg Kroah-Hartman]

On Tue, Oct 20, 2026 at 03:26:29PM +1000, Yu Zhang wrote:
> Hi,
> 
> f_tcm frees its per-endpoint USB requests on the teardown path without
> waiting for in-flight target_core commands to finish, so a command that
> is still being processed by the backend when the gadget is disconnected
> completes into freed/NULL request memory.

Great, can you submit a patch for this?

thanks,

greg k-h