From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DED6331EBD for ; Tue, 9 Jun 2026 19:36:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781033799; cv=none; b=MPzUBR51CcnfUMhSDS8AMQKfsHR13lwyY+rO3k0ykADt//PmKaoiSXZlNtye3+kt4wr4M7Rd7RvUnFtTiMZgximS+AsFChFxrA0az6OkKbc/OWomOafvSm0mSHfMxDPy2jSgq8y6OoHizdi5iik3rcNOFHzGKopaQfXfTbesaOE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781033799; c=relaxed/simple; bh=T+aPMEJT5NnNy8BkW+/rylqOBIskIu++WlFWEjTOe3c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mJzhwPeo+G3i/qkrul4ujhWJMeqLgPtylsGUfIrzs5z3UEkBvtSYyFvDAtO4FmQ2c7CEojcomHBL1MQO6KHPBAkGvW6nA50Sd3c6AZcK5BjRy2DAuxLaMnHs4UBMpW7r6J4cek0GwiIoDWZhB/bLBBZhJLwt6vgz/2QmsWbS0N4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=PEFeRh3F; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=ciH76kAI; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="PEFeRh3F"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="ciH76kAI" Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 659GOOeI3196577 for ; Tue, 9 Jun 2026 19:36:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=qcppdkim1; bh=b3/gTmE9+0HaJh4TOwTte717fwVuFSpspy0 hY56wF8I=; b=PEFeRh3FNCi25W3NPltGE7NaJs3dED1nbF64y/bI/XFOWje1EOk hNGzEsoWYS0cNV2h3FlsgZRlC+yRurSuREf6a7YrNjAikk3tE+vgJMzrFHFSeEp/ H4lKSsge+e48dlSk13XpMf0iYdKPzNGZ+1BLGB8Y6GtoVC0kdTzlC4VNFYdOVCE9 kICsJLRUe97MnoYkGw0xkZ9zdMKsCrqGLszmzIgeswhk6kf6Mz5ID2ZzmfIvGLRo InqzzpgXQGHguGUoXafwPt6AffeK0T/851pPB3GSKBPzAY/PnbQmWzhVbDwEMTCH SlBoJ3hNdp3d2szxl643wthmv6VtZsZkqaw== Received: from mail-yx1-f70.google.com (mail-yx1-f70.google.com [74.125.224.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4epg3v2ygn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 09 Jun 2026 19:36:37 +0000 (GMT) Received: by mail-yx1-f70.google.com with SMTP id 956f58d0204a3-660575c74f1so11036237d50.3 for ; Tue, 09 Jun 2026 12:36:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781033797; x=1781638597; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=b3/gTmE9+0HaJh4TOwTte717fwVuFSpspy0hY56wF8I=; b=ciH76kAIBnjUNLJq6zXu+6uQOaSODpL/gqygmxcV03wMfIqv8xMTvFSIb56RtIXjld D6nbuw3ioh+yOlQRSJmW/El18xiCdXU5kNqMp/Uq+dMVI+N9c2aeDrw+M1i6Atl0webs JpVdP+iZQwqPDcZE6GXpc+nzB//0SE/wX6uD4o1sanLVnz9ooqxoEcZ85Zh9EFXHjFKK UZghiYYyDMx8+D8YMpeArA9Bir3tKYnhhkJM9aumuM+G7zG9bMUr6zP55Ax58EvfHoeo 05EmJ3mfWAHAXRNdDKvHuwNDo+s66zrpenFuQSbt+CdQ72+TjT3YbniA6wljJ6aFqsSp mUNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781033797; x=1781638597; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=b3/gTmE9+0HaJh4TOwTte717fwVuFSpspy0hY56wF8I=; b=FbGzj/4xu2uJDd90n81r50/l/e8GI9VJ6c9tD7YrBKlllQPpky1wLdX39dnxdziEGw 0jDTVWu3YJCK5hQNgjFQxkODjsx40FzN5QA0voGAE4Ht+R26kizYJ1Bp6fs2mG0cPDdC xc6aYwhDVCr1d1I6A7Qgf4p0zX65804pLvCq6KSqO88etu7866UsaePl3WANQdqWf494 lZ8/hz97y+BOk1ewrP3Lm6HFqsQgmfvz3+yjfxCV8WE3CFnUq9Gm2FNK8yUaLMRNpviF dj7RLh1IXDrby/k0SL3DAjCWf+RysSffBu/a3odLlLVhouH7upbyMfqJXsGHJ5jmR62+ Tlwg== X-Forwarded-Encrypted: i=1; AFNElJ86E9OrDbQ2f9dA4bChD5dL36zOd5p6jNapRjKLIGGQqx14jEByJNot0ruuirALwkw1Yo80d2/xzHQG9Cc=@vger.kernel.org X-Gm-Message-State: AOJu0Yw38fXiHSFE/vsE77fa/iYUsKpY8+izv86RQ98wclJpe4oDf5PR Zq3fvkPmm8nagm2UdNgg5PqJokYmeQ77CQ3wSVGLfZZZMYE8z9FZHgPcVmqSvJBFsW/2tZ6dqLv FRIcNhnQOfkGNb9UdP+XN4m85vVephEiAVh0dCaTjWQE5EqnFFPws5P8FYWOfAdIsV4E= X-Gm-Gg: Acq92OEUmo7bF2dqSyzaQVRKfwvj9xPL8PkB1EsC1QgaKVP1nvtugmpVVmHNxVlC0Fl E/eWK0iZg99BWpamDI2uwzptb5XxoCEttghynY83N5h5vINGqE0E0AWfEVH+PPSsbQ246TMeWE+ S7GQhPxeTkVrBGVoyI2j+jEEYM1OV9PdkLCuC9rDU1MUuS4uIasUMgl6sZeb5X+L1V0j+neq5yG EMUdof1QuVpnOn8FmwRusQAGQTvfLl2+IYYmvOZCf63WOb3gHiQzmfVHrS9rtNuKdFxFEaoStsX r9wjVemJ4zyJFoJB8wknBLnZU+fVgfZaSzUQl7A8czCjcObEKuDG0K7Unw1om6F3R6cm8oYZro+ LbtXZga8qj8EBRC962ir1SLDj281pH9QhdVYuerMASEA3vnHEOLO/qPBZ8ThDfQxftRw+6HVXQj RyiuDDWQ7CFptV+Xqg1g== X-Received: by 2002:a05:690e:1c07:b0:65e:5aa3:9640 with SMTP id 956f58d0204a3-66106e51bc9mr18614808d50.25.1781033796876; Tue, 09 Jun 2026 12:36:36 -0700 (PDT) X-Received: by 2002:a05:690e:1c07:b0:65e:5aa3:9640 with SMTP id 956f58d0204a3-66106e51bc9mr18614776d50.25.1781033796505; Tue, 09 Jun 2026 12:36:36 -0700 (PDT) Received: from x1e.lan (108-208-224-205.lightspeed.gnbonc.sbcglobal.net. [108.208.224.205]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-660d5f89271sm11272768d50.8.2026.06.09.12.36.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 12:36:36 -0700 (PDT) From: Tyler Baker To: Greg Kroah-Hartman , Robert Baldyga , Michal Nazarewicz , Felipe Balbi Cc: Tyler Baker , stable@vger.kernel.org, Loic Poulain , Dmitry Baryshkov , Srinivas Kandagatla , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] usb: gadget: f_fs: initialize reset_work at allocation time Date: Tue, 9 Jun 2026 15:36:34 -0400 Message-ID: <20260609193635.2284430-1-tyler.baker@oss.qualcomm.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=St6gLvO0 c=1 sm=1 tr=0 ts=6a286b45 cx=c_pps a=S/uc88zpIJVNbziUnJ6G4Q==:117 a=PFxtTy0squD/fJwW5Be2sw==:17 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=lHVxNFqqooF5E1-8HV4A:9 a=nd2WpGr1bMy9NW-iytEl:22 X-Proofpoint-ORIG-GUID: F6QL7zRu7rDP6SD8PZ26kk9e6CawpCZc X-Proofpoint-GUID: F6QL7zRu7rDP6SD8PZ26kk9e6CawpCZc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjA5MDE4MyBTYWx0ZWRfXxCIi1No74iEF LZBiN7jJKL1MHad7bkP71WZyg59aMFM2TI4wYheid5DX6aNoOxd76ACKj2Rchc1IDLWyxevPZeW 1AJ1kNTRZ54NvH0N9mXFAzOr6wsD6jg+Ma+YeZFC0/9FuEhWYLIpIqjRG1cseTKsck83V7vO6nh HdkFofEx/0zdpA5t1WuROqG1dt1ZNo8ZjGOSHjHiUlmnUEotNOasQwIyv/YcfTekwuoQY/e9clg QzKSdJ+fD7DKxprGoj8DSEndDoEGNq5UeSq4mTuMOZSw4hRWae+X9yJnvmWMqU4xUXudqmOYeGD O3wP/Sa1hXlbHFIricHyzaTOIQ+8+/l2b3XfkM0cgOTcX9p6G01EjColqVEdMIII+dkitF5r/47 ePhdVfp71dd8huSOndj3ZUWrSSOuXKLRmMYO9+zRQmETtQ/rjyMkaPbjUrDuvQE9ThJST7nW82P V4rqxCAp/MSSczQ3d4g== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-09_04,2026-06-09_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 suspectscore=0 adultscore=0 lowpriorityscore=0 clxscore=1011 spamscore=0 bulkscore=0 phishscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606090183 ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on ffs->reset_work when a functionfs instance is unmounted: ffs_data_reset(ffs); cancel_work_sync(&ffs->reset_work); However ffs->reset_work is only ever initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable(), and only on the FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed() when the instance is mounted with the "no_disconnect" option, so for the common case (no "no_disconnect", or mounted and unmounted without ever being deactivated) reset_work is never initialized. ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch it either, so reset_work.func is left NULL. cancel_work_sync() on such a work then trips the WARN_ON(!work->func) guard in __flush_work(): WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount Call trace: __flush_work cancel_work_sync ffs_fs_kill_sb [usb_f_fs] deactivate_locked_super deactivate_super cleanup_mnt __cleanup_mnt task_work_run exit_to_user_mode_loop el0_svc On older kernels cancel_work_sync() on a zero-initialized work struct was a silent no-op, which hid the missing initialization. Initialize reset_work once in ffs_data_new() so it is always valid for the lifetime of the ffs_data, and drop the now-redundant INIT_WORK() calls from the two deactivation paths. Fixes: 18d6b32fca38 ("usb: gadget: f_fs: add "no_disconnect" mode") Cc: stable@vger.kernel.org Signed-off-by: Tyler Baker Cc: Loic Poulain Cc: Dmitry Baryshkov Cc: Srinivas Kandagatla --- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 75912ce6ab55..1ee21e29ef73 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -288,6 +288,7 @@ static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data); static void ffs_release_dev(struct ffs_dev *ffs_dev); static int ffs_ready(struct ffs_data *ffs); static void ffs_closed(struct ffs_data *ffs); +static void ffs_reset_work(struct work_struct *work); /* Misc helper functions ****************************************************/ @@ -2221,6 +2222,7 @@ static struct ffs_data *ffs_data_new(const char *dev_name) init_waitqueue_head(&ffs->ev.waitq); init_waitqueue_head(&ffs->wait); init_completion(&ffs->ep0req_completion); + INIT_WORK(&ffs->reset_work, ffs_reset_work); /* XXX REVISIT need to update it in some places, or do we? */ ffs->ev.can_stall = 1; @@ -3775,7 +3777,6 @@ static int ffs_func_set_alt(struct usb_function *f, if (ffs->state == FFS_DEACTIVATED) { ffs->state = FFS_CLOSING; spin_unlock_irqrestore(&ffs->eps_lock, flags); - INIT_WORK(&ffs->reset_work, ffs_reset_work); schedule_work(&ffs->reset_work); return -ENODEV; } @@ -3806,7 +3807,6 @@ static void ffs_func_disable(struct usb_function *f) if (ffs->state == FFS_DEACTIVATED) { ffs->state = FFS_CLOSING; spin_unlock_irqrestore(&ffs->eps_lock, flags); - INIT_WORK(&ffs->reset_work, ffs_reset_work); schedule_work(&ffs->reset_work); return; } -- 2.43.0