[PATCH] usb: gadget: f_fs: Init reset_work at alloc to avoid kill_sb WARN

From: Ondřej Jirman

Date: Sat Jul 25 2026 - 08:08:57 EST


From: Ondrej Jirman <megi@xxxxxx>

ffs_data is zero-allocated and reset_work is only INIT_WORK'd on the
FFS_DEACTIVATED path in set_alt/disable, which the normal flow never
takes. ffs_fs_kill_sb() then cancel_work_sync()s it unconditionally,
tripping the WARN_ON(!work->func) in __flush_work() with a NULL func.

Initialize reset_work once in ffs_data_new() and drop the redundant
lazy INIT_WORK calls.

Signed-off-by: Ondrej Jirman <megi@xxxxxx>
---
drivers/usb/gadget/function/f_fs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 75912ce6ab55..a7b08180277f 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -54,6 +54,9 @@ MODULE_IMPORT_NS("DMA_BUF");
/* Reference counter handling */
static void ffs_data_get(struct ffs_data *ffs);
static void ffs_data_put(struct ffs_data *ffs);
+
+static void ffs_reset_work(struct work_struct *work);
+
/* Creates new ffs_data object. */
static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
__attribute__((malloc));
@@ -2222,6 +2225,8 @@ static struct ffs_data *ffs_data_new(const char *dev_name)
init_waitqueue_head(&ffs->wait);
init_completion(&ffs->ep0req_completion);

+ INIT_WORK(&ffs->reset_work, ffs_reset_work);
+
/* XXX REVISIT need to update it in some places, or do we? */
ffs->ev.can_stall = 1;

@@ -3775,7 +3780,6 @@ static int ffs_func_set_alt(struct usb_function *f,
if (ffs->state == FFS_DEACTIVATED) {
ffs->state = FFS_CLOSING;
spin_unlock_irqrestore(&ffs->eps_lock, flags);
- INIT_WORK(&ffs->reset_work, ffs_reset_work);
schedule_work(&ffs->reset_work);
return -ENODEV;
}
@@ -3806,7 +3810,6 @@ static void ffs_func_disable(struct usb_function *f)
if (ffs->state == FFS_DEACTIVATED) {
ffs->state = FFS_CLOSING;
spin_unlock_irqrestore(&ffs->eps_lock, flags);
- INIT_WORK(&ffs->reset_work, ffs_reset_work);
schedule_work(&ffs->reset_work);
return;
}
--
2.54.0