usb: gadget: f_tcm: Cleanup requests on ep disable

There may be different reasons for the transfer to be cancelled. Don't
blindly free the command without checking its status. We may still need
to properly respond to cancelled command. Check and only free the
command on endpoint disable.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/6c4ae2b4c2a9037bdcb6f909e173a94b11f04657.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 2a74414c7fd14122a4d5034d65568431cf45ebf3..8a5aa58e166e607b3870f7ac273b68aab1d9f3e9 100644 (file)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -196,6 +196,11 @@ static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
        if (req->status < 0)
                pr_err("ERR %s(%d)\n", __func__, __LINE__);
 
+       if (req->status == -ESHUTDOWN) {
+               transport_generic_free_cmd(&cmd->se_cmd, 0);
+               return;
+       }
+
        bot_send_status(cmd, true);
 }
 
@@ -550,7 +555,7 @@ static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
        struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
        int ret;
 
-       if (req->status < 0)
+       if (req->status == -ESHUTDOWN)
                goto cleanup;
 
        switch (cmd->state) {
@@ -915,7 +920,13 @@ static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
 
        cmd->state = UASP_QUEUE_COMMAND;
 
-       if (req->status < 0) {
+       if (req->status == -ESHUTDOWN) {
+               target_put_sess_cmd(se_cmd);
+               transport_generic_free_cmd(&cmd->se_cmd, 0);
+               return;
+       }
+
+       if (req->status) {
                pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
                goto cleanup;
        }