Re: [PATCH] usb: gadget: f_midi: initialize work in f_midi_alloc()
Takashi Iwai <[email protected]>
| Newsgroups | org.kernel.vger.linux-usb,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 15 Aug 2026 07:40:06 +0200, Jeffin Philip wrote: > > f_midi_alloc initializes free_ref to 1 and it can only be incremented > when a sound card is registered via f_midi_register_card(). > f_midi_register_card() is only called in f_midi_bind() which actually > performs INIT_WORK. If f_midi_bind() is never run, work is not > initialized and the if condition in f_midi_free becomes true, > this results in a warning later in __flush_work as work->func = 0. > Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc(). > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=d5fa3d224505c8610702 > Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work") > Cc: [email protected] > Signed-off-by: Jeffin Philip <[email protected]> Reviewed-by: Takashi Iwai <[email protected]> thanks, Takashi