Re: [PATCH] usb: gadget: f_midi: initialize work in f_midi_alloc()
Takashi Iwai <[email protected]>
| Newsgroups | gmane.linux.usb.general,gmane.linux.kernel,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 15 Aug 2026 07:40:06 +0200,
Jeffin Philip wrote:
>
> f_midi_alloc initializes free_ref to 1 and it can only be incremented
> when a sound card is registered via f_midi_register_card().
> f_midi_register_card() is only called in f_midi_bind() which actually
> performs INIT_WORK. If f_midi_bind() is never run, work is not
> initialized and the if condition in f_midi_free becomes true,
> this results in a warning later in __flush_work as work->func = 0.
> Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc().
>
> Reported-by: syzbot+d5fa3d224505c8610702-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org
> Closes: https://syzkaller.appspot.com/bug?extid=d5fa3d224505c8610702
> Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work")
> Cc: [email protected]
> Signed-off-by: Jeffin Philip <[email protected]>
Reviewed-by: Takashi Iwai <[email protected]>
thanks,
Takashi