Re: [PATCH v2] usb: gadget: f_tcm: fix remaining nexus NULL dereferences

[Thinh Nguyen]

On Sat, Jul 04, 2026, Guangshuo Li wrote:
> The previous nexus NULL-dereference fix added checks to the normal
> command submission paths, but two UASP paths still dereference
> tpg->tpg_nexus without checking it first.
> 
> A TASK MANAGEMENT request reaches usbg_submit_tmr(), which fetches
> tvn_se_sess directly from tpg->tpg_nexus. The RC_OVERLAPPED_TAG path in
> usbg_cmd_work() does the same before walking sess_cmd_map for the active
> command with the same tag.
> 
> If userspace drops the nexus after the command is queued, these paths can
> observe a NULL tpg_nexus and crash before they can ignore the command like
> the already-fixed command paths do.
> 
> Commands that reach the workqueue have already been allocated from the
> session tag pool by usbg_get_cmd(), and UASP commands may have been
> inserted into the stream hash. Clean up those resources before returning
> from nexus-missing paths.
> 
> Store the session pointer in struct usbg_cmd so the cleanup path does not
> need to dereference tpg_nexus after it becomes NULL.
> 
> Fixes: b9fde5073553 ("usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
> v2:
>   - Clean up the session tag pool and stream hash before returning from
>     nexus-missing paths, as suggested by Thinh.
>   - Store the session pointer in struct usbg_cmd so the cleanup path does
>     not need to dereference tpg_nexus after it becomes NULL.
> 
>  drivers/usb/gadget/function/f_tcm.c | 48 ++++++++++++++++++++++++++---
>  drivers/usb/gadget/function/tcm.h   |  1 +
>  2 files changed, 45 insertions(+), 4 deletions(-)
> 

Reviewed-by: Thinh Nguyen <Thinh.Nguyen@xxxxxxxxxxxx>

Thanks,
Thinh