Linux USB
 help / color / mirror / Atom feed
From: "Ondřej Jirman" <megi@xff.cz>
To: linux-usb@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Ondrej Jirman <megi@xff.cz>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Al Viro <viro@zeniv.linux.org.uk>, Sam Day <me@samcday.com>,
	Michael Bommarito <michael.bommarito@gmail.com>,
	fanggeng <fanggeng@lixiang.com>,
	Mateusz Guzik <mjguzik@gmail.com>, Kees Cook <kees@kernel.org>
Subject: [PATCH] usb: gadget: f_fs: Init reset_work at alloc to avoid kill_sb WARN
Date: Sat, 25 Jul 2026 14:08:34 +0200	[thread overview]
Message-ID: <20260725120838.2263579-1-megi@xff.cz> (raw)

From: Ondrej Jirman <megi@xff.cz>

ffs_data is zero-allocated and reset_work is only INIT_WORK'd on the
FFS_DEACTIVATED path in set_alt/disable, which the normal flow never
takes. ffs_fs_kill_sb() then cancel_work_sync()s it unconditionally,
tripping the WARN_ON(!work->func) in __flush_work() with a NULL func.

Initialize reset_work once in ffs_data_new() and drop the redundant
lazy INIT_WORK calls.

Signed-off-by: Ondrej Jirman <megi@xff.cz>
---
 drivers/usb/gadget/function/f_fs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 75912ce6ab55..a7b08180277f 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -54,6 +54,9 @@ MODULE_IMPORT_NS("DMA_BUF");
 /* Reference counter handling */
 static void ffs_data_get(struct ffs_data *ffs);
 static void ffs_data_put(struct ffs_data *ffs);
+
+static void ffs_reset_work(struct work_struct *work);
+
 /* Creates new ffs_data object. */
 static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
 	__attribute__((malloc));
@@ -2222,6 +2225,8 @@ static struct ffs_data *ffs_data_new(const char *dev_name)
 	init_waitqueue_head(&ffs->wait);
 	init_completion(&ffs->ep0req_completion);
 
+	INIT_WORK(&ffs->reset_work, ffs_reset_work);
+
 	/* XXX REVISIT need to update it in some places, or do we? */
 	ffs->ev.can_stall = 1;
 
@@ -3775,7 +3780,6 @@ static int ffs_func_set_alt(struct usb_function *f,
 	if (ffs->state == FFS_DEACTIVATED) {
 		ffs->state = FFS_CLOSING;
 		spin_unlock_irqrestore(&ffs->eps_lock, flags);
-		INIT_WORK(&ffs->reset_work, ffs_reset_work);
 		schedule_work(&ffs->reset_work);
 		return -ENODEV;
 	}
@@ -3806,7 +3810,6 @@ static void ffs_func_disable(struct usb_function *f)
 	if (ffs->state == FFS_DEACTIVATED) {
 		ffs->state = FFS_CLOSING;
 		spin_unlock_irqrestore(&ffs->eps_lock, flags);
-		INIT_WORK(&ffs->reset_work, ffs_reset_work);
 		schedule_work(&ffs->reset_work);
 		return;
 	}
-- 
2.54.0


                 reply	other threads:[~2026-07-25 12:08 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260725120838.2263579-1-megi@xff.cz \
    --to=megi@xff.cz \
    --cc=fanggeng@lixiang.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=kees@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=me@samcday.com \
    --cc=michael.bommarito@gmail.com \
    --cc=mjguzik@gmail.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox