Issue of the Implementation # L0220
usb: gadget: bdc_udc: fix race condition in bdc_udc_exit()
bdc_ep_disable() expects to be called with bdc->lock held. The assumption is met in all the cases except for call from bdc_udc_exit(), that is called from bdc_remove(). As a result a race can happen or unheld bdc->lock can be unlocked in bdc_req_complete().
Fixed in kernel 4.6-rc1