From 1544775687f093e799439fca5519340b88c84e2c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 17 Nov 2025 16:49:59 -0500 Subject: [PATCH] functionfs: need to cancel ->reset_work in ->kill_sb() ... otherwise we just might free ffs with ffs->reset_work still on queue. That needs to be done after ffs_data_reset() - that's the cutoff point for configfs accesses (serialized on gadget_info->lock), which is where the schedule_work() would come from. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro --- drivers/usb/gadget/function/f_fs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 0bcff49e1f11e..27860fc0fd7d1 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -2081,6 +2081,9 @@ ffs_fs_kill_sb(struct super_block *sb) struct ffs_data *ffs = sb->s_fs_info; ffs->state = FFS_CLOSING; ffs_data_reset(ffs); + // no configfs accesses from that point on, + // so no further schedule_work() is possible + cancel_work_sync(&ffs->reset_work); ffs_data_put(ffs); } } -- 2.47.3