Hello,

This patch series refactors the error-handling paths in the bind()
function for f_ncm, f_acm, f_ecm, and f_rndis drivers. 

The current, unified goto logic in these drivers is vulnerable to a null
pointer dereference. This is caused by the cleanup logic incorrectly
handling the stale usb_request pointer after a bind/unbind cycle. This
series fixes this issue by converting the drivers to use the modern
__free() scope-based cleanup mechanism.

Patches 1-2 are preparatory, adding the endpoint pointer to struct
usb_request and defining helpers for the __free() cleanup. The remaining
four patches use this new plumbing to refactor each driver.

Future work
-----------

1. Refactor usb_ep_free_request(), usb_ep_queue(), and usb_ep_dequeue()
   functions as the ep parameter becomes redudant.
2. Convert the remaining gadget function drivers to use the new __free()
   cleanup mechanism.

Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
---
Kuen-Han Tsai (6):
      usb: gadget: Store endpoint pointer in usb_request
      usb: gadget: Introduce free_usb_request helper
      usb: gadget: f_ncm: Refactor bind path to use __free()
      usb: gadget: f_acm: Refactor bind path to use __free()
      usb: gadget: f_ecm: Refactor bind path to use __free()
      usb: gadget: f_rndis: Refactor bind path to use __free()

 drivers/usb/gadget/function/f_acm.c   | 42 ++++++++---------
 drivers/usb/gadget/function/f_ecm.c   | 48 +++++++++-----------
 drivers/usb/gadget/function/f_ncm.c   | 78 ++++++++++++++------------------
 drivers/usb/gadget/function/f_rndis.c | 85 +++++++++++++++--------------------
 drivers/usb/gadget/udc/core.c         |  3 ++
 include/linux/usb/gadget.h            | 25 +++++++++++
 6 files changed, 135 insertions(+), 146 deletions(-)
---
base-commit: 1b237f190eb3d36f52dffe07a40b5eb210280e00
change-id: 20250916-ready-70b1c55d14b6

Best regards,
-- 
Kuen-Han Tsai <khtsai@google.com>