--- /dev/null
+From a19bda861b3a79e25417462539df8b0d77c6b322 Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Thu, 16 Jul 2026 10:22:43 +0000
+Subject: rust: device: avoid trailing ; in printing macros
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit a19bda861b3a79e25417462539df8b0d77c6b322 upstream.
+
+These macros are used like expressions, so they should not emit a
+semicolon. This is being turned into a hard error in a future release of
+Rust.
+
+ error: trailing semicolon in macro used in expression position
+ --> drivers/gpu/nova-core/firmware/fsp.rs:79:34
+ |
+ 79 | .inspect_err(|_| dev_err!(dev, "FMC firmware missing '{}' section\n", name))
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ |
+ = warning: this was previously accepted by the compiler but is being phased out; it will become a hard error in a future release!
+ = note: for more information, see issue #79813 <https://github.com/rust-lang/rust/issues/79813>
+ = note: this error originates in the macro `dev_err` (in Nightly builds, run with -Z macro-backtrace for more info)
+
+[ I was doubly surprised since upstream made it a deny-by-default lint
+ a year ago for Rust 1.91.0, and yet we didn't see it; plus I hadn't
+ seen this in my CI even yesterday.
+
+ It turns out this just landed into today's nightly (nightly-2026-07-16,
+ using upstream commit d0babd8b6):
+
+ Link: https://github.com/rust-lang/rust/pull/159222
+
+ which says:
+
+ "The `semicolon_in_expressions_from_macros` lint previously
+ suppressed warnings about non-local macros. This masks
+ a lint that will subsequently become a hard error."
+
+ So that explains it. And this is the PR that will make it a hard error
+ at some point in the future:
+
+ Link: https://github.com/rust-lang/rust/pull/159218
+
+ Thus starting with Rust 1.99.0 (expected 2026-10-01), we will be
+ seeing the deny-by-default lint above, so clean it up already.
+
+ - Miguel ]
+
+Cc: stable@vger.kernel.org # Needed in 6.18.y and later.
+Link: https://github.com/rust-lang/rust/issues/79813
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Acked-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://github.com/rust-lang/rust/pull/159218
+Link: https://github.com/rust-lang/rust/pull/159222
+Link: https://patch.msgid.link/20260716-device-trail-semicolon-v1-1-f48e9dcfae15@google.com
+[ Fixed typo. ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+[ Resolved conflict on `dev_printk` by not performing a similar cleanup
+ since it is not strictly needed. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/device.rs | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/rust/kernel/device.rs
++++ b/rust/kernel/device.rs
+@@ -625,7 +625,7 @@ macro_rules! dev_printk {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_emerg {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_emerg, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_emerg, $($f)*) }
+ }
+
+ /// Prints an alert-level message (level 1) prefixed with device information.
+@@ -651,7 +651,7 @@ macro_rules! dev_emerg {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_alert {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_alert, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_alert, $($f)*) }
+ }
+
+ /// Prints a critical-level message (level 2) prefixed with device information.
+@@ -677,7 +677,7 @@ macro_rules! dev_alert {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_crit {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_crit, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_crit, $($f)*) }
+ }
+
+ /// Prints an error-level message (level 3) prefixed with device information.
+@@ -703,7 +703,7 @@ macro_rules! dev_crit {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_err {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_err, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_err, $($f)*) }
+ }
+
+ /// Prints a warning-level message (level 4) prefixed with device information.
+@@ -729,7 +729,7 @@ macro_rules! dev_err {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_warn {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_warn, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_warn, $($f)*) }
+ }
+
+ /// Prints a notice-level message (level 5) prefixed with device information.
+@@ -755,7 +755,7 @@ macro_rules! dev_warn {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_notice {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_notice, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_notice, $($f)*) }
+ }
+
+ /// Prints an info-level message (level 6) prefixed with device information.
+@@ -781,7 +781,7 @@ macro_rules! dev_notice {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_info {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_info, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_info, $($f)*) }
+ }
+
+ /// Prints a debug-level message (level 7) prefixed with device information.
+@@ -807,5 +807,5 @@ macro_rules! dev_info {
+ /// ```
+ #[macro_export]
+ macro_rules! dev_dbg {
+- ($($f:tt)*) => { $crate::dev_printk!(pr_dbg, $($f)*); }
++ ($($f:tt)*) => { $crate::dev_printk!(pr_dbg, $($f)*) }
+ }
--- /dev/null
+From 79e2d75725c85607f8a9d87ae9cace62a19f767d Mon Sep 17 00:00:00 2001
+From: Cen Zhang <zzzccc427@gmail.com>
+Date: Sat, 27 Jun 2026 18:41:53 +0800
+Subject: usb: gadget: f_tcm: synchronize delayed set_alt with teardown
+
+From: Cen Zhang <zzzccc427@gmail.com>
+
+commit 79e2d75725c85607f8a9d87ae9cace62a19f767d upstream.
+
+The f_tcm set_alt() path defers endpoint setup to a work item and
+completes the delayed status response from process context. The delayed
+work uses f_tcm private state and may complete the setup request after
+disconnect or function teardown has already moved on.
+
+Cancel and drain the delayed set_alt work when the function is unbound or
+freed. For disable paths, which are reached under the composite device
+lock, use a small state machine and a non-sleeping cancellation path
+instead of cancel_work_sync(). If the work is already running, mark it
+cancelled and let the worker own the cleanup; otherwise tcm_disable() can
+cancel the queued work and clean up immediately.
+
+Also serialize the final delayed-status completion with the cancellation
+check while holding the composite device lock. This prevents a disconnect
+from clearing delayed_status while the worker is about to complete the
+control request.
+
+Validation reproduced this kernel report:
+BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0
+
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x66/0xa0
+ print_report+0xce/0x630
+ ? tcm_delayed_set_alt+0x6c/0xef0
+ ? srso_alias_return_thunk+0x5/0xfbef5
+ ? __virt_addr_valid+0x188/0x320
+ ? tcm_delayed_set_alt+0x6c/0xef0
+ kasan_report+0xe0/0x110
+ ? tcm_delayed_set_alt+0x6c/0xef0
+ tcm_delayed_set_alt+0x6c/0xef0
+ ? __pfx_tcm_delayed_set_alt+0x10/0x10
+ ? process_one_work+0x4cb/0xb90
+ ? rcu_is_watching+0x20/0x50
+ ? tcm_delayed_set_alt+0x9/0xef0
+ process_one_work+0x4d7/0xb90
+ ? __pfx_process_one_work+0x10/0x10
+ ? srso_alias_return_thunk+0x5/0xfbef5
+ ? __list_add_valid_or_report+0x37/0xf0
+ ? __pfx_tcm_delayed_set_alt+0x10/0x10
+ ? srso_alias_return_thunk+0x5/0xfbef5
+ worker_thread+0x2d8/0x570
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0x1ad/0x1f0
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x3c9/0x540
+ ? __pfx_ret_from_fork+0x10/0x10
+ ? srso_alias_return_thunk+0x5/0xfbef5
+ ? __switch_to+0x2e9/0x730
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Allocated by task 544:
+ kasan_save_stack+0x33/0x60
+ kasan_save_track+0x14/0x30
+ __kasan_kmalloc+0x8f/0xa0
+ tcm_alloc+0x68/0x180
+ usb_get_function+0x36/0x60
+ config_usb_cfg_link+0x125/0x1b0
+ configfs_symlink+0x322/0x890
+ vfs_symlink+0xc2/0x270
+ filename_symlinkat+0x295/0x2f0
+ __x64_sys_symlinkat+0x62/0x90
+ do_syscall_64+0x115/0x6a0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 661:
+ kasan_save_stack+0x33/0x60
+ kasan_save_track+0x14/0x30
+ kasan_save_free_info+0x3b/0x60
+ __kasan_slab_free+0x43/0x70
+ kfree+0x2f9/0x530
+ config_usb_cfg_unlink+0x173/0x1e0
+ configfs_unlink+0x1fa/0x340
+ vfs_unlink+0x15c/0x510
+ filename_unlinkat+0x2ba/0x450
+ __x64_sys_unlinkat+0x63/0x90
+ do_syscall_64+0x115/0x6a0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
+Cc: stable <stable@kernel.org>
+Assisted-by: Codex:gpt-5.5
+Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
+Link: https://patch.msgid.link/20260627104153.3822495-1-zzzccc427@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_tcm.c | 192 ++++++++++++++++++++++++++++++------
+ drivers/usb/gadget/function/tcm.h | 13 ++
+ 2 files changed, 177 insertions(+), 28 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -2361,31 +2361,158 @@ ep_fail:
+ return -ENOTSUPP;
+ }
+
+-struct guas_setup_wq {
+- struct work_struct work;
+- struct f_uas *fu;
+- unsigned int alt;
+-};
++static void tcm_cleanup_old_alt(struct f_uas *fu)
++{
++ if (fu->flags & USBG_IS_UAS)
++ uasp_cleanup_old_alt(fu);
++ else if (fu->flags & USBG_IS_BOT)
++ bot_cleanup_old_alt(fu);
++ fu->flags = 0;
++}
++
++static void tcm_delayed_set_alt_done(struct f_uas *fu)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
++ fu->delayed_set_alt_cancel = false;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++}
++
++static bool tcm_delayed_set_alt_cancelled(struct f_uas *fu)
++{
++ bool cancelled;
++ unsigned long flags;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ cancelled = fu->delayed_set_alt_cancel;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++
++ return cancelled;
++}
++
++static bool tcm_complete_delayed_status(struct f_uas *fu)
++{
++ struct usb_composite_dev *cdev = fu->function.config->cdev;
++ struct usb_request *req = cdev->req;
++ unsigned long cdev_flags;
++ bool cancelled;
++ int ret;
++
++ spin_lock_irqsave(&cdev->lock, cdev_flags);
++ spin_lock(&fu->delayed_set_alt_lock);
++ cancelled = fu->delayed_set_alt_cancel;
++ if (!cancelled) {
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
++ fu->delayed_set_alt_cancel = false;
++ }
++ spin_unlock(&fu->delayed_set_alt_lock);
++
++ if (cancelled) {
++ spin_unlock_irqrestore(&cdev->lock, cdev_flags);
++ return false;
++ }
++
++ if (cdev->delayed_status == 0) {
++ WARN(cdev, "%s: Unexpected call\n", __func__);
++ } else if (--cdev->delayed_status == 0) {
++ req->length = 0;
++ req->context = cdev;
++ ret = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
++ if (ret == 0) {
++ cdev->setup_pending = true;
++ } else {
++ req->status = 0;
++ req->complete(cdev->gadget->ep0, req);
++ }
++ }
++
++ spin_unlock_irqrestore(&cdev->lock, cdev_flags);
++
++ return true;
++}
++
++static bool tcm_cancel_delayed_set_alt(struct f_uas *fu)
++{
++ bool cleanup = false;
++ bool cancel = false;
++ unsigned long flags;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ switch (fu->delayed_set_alt_state) {
++ case USBG_DELAYED_SET_ALT_IDLE:
++ cleanup = true;
++ break;
++ case USBG_DELAYED_SET_ALT_QUEUED:
++ case USBG_DELAYED_SET_ALT_RUNNING:
++ fu->delayed_set_alt_cancel = true;
++ cancel = true;
++ break;
++ }
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++
++ if (cancel && cancel_work(&fu->delayed_set_alt)) {
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ if (fu->delayed_set_alt_state == USBG_DELAYED_SET_ALT_QUEUED) {
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
++ fu->delayed_set_alt_cancel = false;
++ cleanup = true;
++ }
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++ }
++
++ return cleanup;
++}
++
++static void tcm_cancel_delayed_set_alt_sync(struct f_uas *fu)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_IDLE)
++ fu->delayed_set_alt_cancel = true;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++
++ cancel_work_sync(&fu->delayed_set_alt);
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_IDLE;
++ fu->delayed_set_alt_cancel = false;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++}
+
+ static void tcm_delayed_set_alt(struct work_struct *wq)
+ {
+- struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
+- work);
+- struct f_uas *fu = work->fu;
+- int alt = work->alt;
++ struct f_uas *fu = container_of(wq, struct f_uas, delayed_set_alt);
++ unsigned long flags;
++ unsigned int alt;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_QUEUED) {
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
++ return;
++ }
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_RUNNING;
++ alt = fu->delayed_alt;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
+
+- kfree(work);
++ tcm_cleanup_old_alt(fu);
+
+- if (fu->flags & USBG_IS_BOT)
+- bot_cleanup_old_alt(fu);
+- if (fu->flags & USBG_IS_UAS)
+- uasp_cleanup_old_alt(fu);
++ if (tcm_delayed_set_alt_cancelled(fu))
++ goto out_done;
+
+ if (alt == USB_G_ALT_INT_BBB)
+ bot_set_alt(fu);
+ else if (alt == USB_G_ALT_INT_UAS)
+ uasp_set_alt(fu);
+- usb_composite_setup_continue(fu->function.config->cdev);
++
++ if (tcm_complete_delayed_status(fu))
++ return;
++
++ tcm_cleanup_old_alt(fu);
++out_done:
++ tcm_delayed_set_alt_done(fu);
+ }
+
+ static int tcm_get_alt(struct usb_function *f, unsigned intf)
+@@ -2411,15 +2538,20 @@ static int tcm_set_alt(struct usb_functi
+ return -EOPNOTSUPP;
+
+ if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
+- struct guas_setup_wq *work;
++ unsigned long flags;
++
++ spin_lock_irqsave(&fu->delayed_set_alt_lock, flags);
++ if (fu->delayed_set_alt_state != USBG_DELAYED_SET_ALT_IDLE) {
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock,
++ flags);
++ return -EBUSY;
++ }
++ fu->delayed_alt = alt;
++ fu->delayed_set_alt_cancel = false;
++ fu->delayed_set_alt_state = USBG_DELAYED_SET_ALT_QUEUED;
++ spin_unlock_irqrestore(&fu->delayed_set_alt_lock, flags);
+
+- work = kmalloc(sizeof(*work), GFP_ATOMIC);
+- if (!work)
+- return -ENOMEM;
+- INIT_WORK(&work->work, tcm_delayed_set_alt);
+- work->fu = fu;
+- work->alt = alt;
+- schedule_work(&work->work);
++ schedule_work(&fu->delayed_set_alt);
+ return USB_GADGET_DELAYED_STATUS;
+ }
+ return -EOPNOTSUPP;
+@@ -2429,11 +2561,8 @@ static void tcm_disable(struct usb_funct
+ {
+ struct f_uas *fu = to_f_uas(f);
+
+- if (fu->flags & USBG_IS_UAS)
+- uasp_cleanup_old_alt(fu);
+- else if (fu->flags & USBG_IS_BOT)
+- bot_cleanup_old_alt(fu);
+- fu->flags = 0;
++ if (tcm_cancel_delayed_set_alt(fu))
++ tcm_cleanup_old_alt(fu);
+ }
+
+ static int tcm_setup(struct usb_function *f,
+@@ -2581,11 +2710,16 @@ static void tcm_free(struct usb_function
+ {
+ struct f_uas *tcm = to_f_uas(f);
+
++ tcm_cancel_delayed_set_alt_sync(tcm);
+ kfree(tcm);
+ }
+
+ static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
+ {
++ struct f_uas *fu = to_f_uas(f);
++
++ tcm_cancel_delayed_set_alt_sync(fu);
++ tcm_cleanup_old_alt(fu);
+ usb_free_all_descriptors(f);
+ }
+
+@@ -2618,6 +2752,8 @@ static struct usb_function *tcm_alloc(st
+ fu->function.disable = tcm_disable;
+ fu->function.free_func = tcm_free;
+ fu->tpg = tpg_instances[i].tpg;
++ INIT_WORK(&fu->delayed_set_alt, tcm_delayed_set_alt);
++ spin_lock_init(&fu->delayed_set_alt_lock);
+
+ hash_init(fu->stream_hash);
+ mutex_unlock(&tpg_instances_lock);
+--- a/drivers/usb/gadget/function/tcm.h
++++ b/drivers/usb/gadget/function/tcm.h
+@@ -3,6 +3,7 @@
+ #define __TARGET_USB_GADGET_H__
+
+ #include <linux/kref.h>
++#include <linux/spinlock.h>
+ /* #include <linux/usb/uas.h> */
+ #include <linux/hashtable.h>
+ #include <linux/usb/composite.h>
+@@ -29,6 +30,12 @@ enum {
+
+ #define USB_G_DEFAULT_SESSION_TAGS USBG_NUM_CMDS
+
++enum {
++ USBG_DELAYED_SET_ALT_IDLE = 0,
++ USBG_DELAYED_SET_ALT_QUEUED,
++ USBG_DELAYED_SET_ALT_RUNNING,
++};
++
+ struct tcm_usbg_nexus {
+ struct se_session *tvn_se_sess;
+ };
+@@ -132,6 +139,12 @@ struct f_uas {
+ #define USBG_BOT_CMD_PEND (1 << 4)
+ #define USBG_BOT_WEDGED (1 << 5)
+
++ struct work_struct delayed_set_alt;
++ spinlock_t delayed_set_alt_lock; /* protects delayed_set_alt_* */
++ unsigned int delayed_alt;
++ unsigned int delayed_set_alt_state;
++ bool delayed_set_alt_cancel;
++
+ struct usbg_cdb cmd[USBG_NUM_CMDS];
+ struct usb_ep *ep_in;
+ struct usb_ep *ep_out;
projects / thirdparty / kernel / stable-queue.git / commitdiff
