Merge "USB: gadget: mass_storage: Fix Null pointer access during disconnect"

	struct fsg_common	*common = ep->driver_data;

	struct fsg_buffhd	*bh = req->context;

	dump_msg(common, "bulk-out", req->buf, req->actual);

	if (req->status || req->actual != bh->bulk_out_intended_length)

		DBG(common, "%s --> %d, %u/%u\n", __func__,

		pr_debug("%s --> %d, %u/%u\n", __func__,

		    req->status, req->actual, bh->bulk_out_intended_length);

	if (req->status == -ECONNRESET)		/* Request was cancelled */

		usb_ep_fifo_flush(ep);

	/* Hold the lock while we update the request and buffer states */

	smp_wmb();

	/*

	 * Disconnect and completion might race each other and driver data

	 * is set to NULL during ep disable. So, add a check if that is case.

	 */

	if (!common) {

		bh->outreq_busy = 0;

		return;

	}

	dump_msg(common, "bulk-out", req->buf, req->actual);

	spin_lock(&common->lock);

	bh->outreq_busy = 0;

	bh->state = BUF_STATE_FULL;