From nobody Mon Sep 28 23:55:26 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E1582C11E6 for ; Sat, 15 Aug 2026 05:40:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786772447; cv=none; b=kijU6133JhJYVF4VrBoDxavwPaKCBiE+iDEfxWLzuLZK5gR9jDjkO/5a+sf8OHmpxCmX4T5xAzAYxonNjNqIG5335MqpXR3W2k25iqPvSaPZd1Zl8aNn5jiBYzL9hmEjRM6C7Iv7r9csjZbTGGXcBxN8awp2oTmErqIas6aoj4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786772447; c=relaxed/simple; bh=RKr8wDx4vfIVDxaydRzoEQ7U5kq6zGMwRmAGuw0kiFY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lbeBOMy0fMONJVYVen2OwsjbRh3BRGu63JO0KAjDO076ecBYwlRPPt7dqpLibkj0hZSXLJZOS1NIj3uIXMz9KBEW7SJyn6KCp9WvdZnEwrZfD0OPy/qPEDtxpvORu0qX4ADEAloMbv0jUg0VQmJTQ7WmyVySCPdbPSitv8LuRtA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QqSFZx6V; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QqSFZx6V" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d0407aedd6so21857955ad.0 for ; Fri, 14 Aug 2026 22:40:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786772445; x=1787377245; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xRZrKjh8gSRFHQ09WnLqzB2J4uOH4YDnOZFIpu3HY00=; b=QqSFZx6Vi/qMcrp+18GwQQlQv7VzP2kxObCUH5kH0AsBU4tsGpKFb7MKOg4QwvK+y0 H6vobr1vPQ+Kminc2iuX73uGHwNpkh0jA9LDQEFhn0ebyt3MOGKromX2O5Z+1DxyJIk/ shKxzYzOBiIeWCVTBASGZq3KhqhD7Kq1r/OXXB26LgjWX5ZnEu28xGLBn3YhDQcjAGBR BFWgdvC26uu99Yze+QECbiL+MbGChCtqc0i7vznLbxDOlcxBUzkT8bX9mPZNQ/9o9GOR tcgE9hHuFEWP9WhjJsVLAq81uR/GVs+iBQTeEUPrNXr1g+l8ZlaMmKeNcMnHwMRDs2Kx Mgvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786772445; x=1787377245; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xRZrKjh8gSRFHQ09WnLqzB2J4uOH4YDnOZFIpu3HY00=; b=LEaOa5wvRTI6QTZN5xrdpa01oNLBMPIms7yQcFXmNGM8qkt3sGP9r3shQ6VAI4jqMg FeCrsr+u//yjoi3XxLu7WmePB62V0S3pzC8aCOqz3zcZ2zabp84pO/XMW//Ew4OUXFFh ny78OAwkUKkubKvAlU1Fh6k+OeTtGVBHB+Cc3jkVkiZehaBGgcdaYYBmMJ0YASY59Ne0 wfQbB6dIhsXqYjj+YcUMZO1Nsq63mQJuuIa77qsFm9G+kvwsd8KJbQOPWjycWZ1/LjoK XTRL8urc9wSAVoWSAC6JSE7+OOv37+5HcLbnt0s8iKH2V14eFjouyK2kB8TjdN1Wpv6X 8oRQ== X-Forwarded-Encrypted: i=1; AHgh+RptwLCCNHBrIJHQNQPFWl7DNK0V/L8z7nNOh1UoZ+1MwEeQx99VbCANor4nnGkYl6JSxKD0ef260nyIoh8=@vger.kernel.org X-Gm-Message-State: AOJu0YxEnZOoDupMBR51Q2qgrbZI/LuNLYwGhr1XRGvsM+xs5UNI+4IY cjh8uEKk0ZCXHG+gRRp6xNrY3G0bMTVt/AdS9L0dQulOB8PuxxB51kah X-Gm-Gg: AR+sD119IMlGC2Gp4TvY4Ek7rtXC9VyYePVU5PnTm21i1UzLKN+T8LMteOiPXM0DOVC dFgOeNfLDTtiN1wgnOy4hE9SUT8lxPL04ujxnOkYauYyhdUE4Ux2HDDVXYrRkPacZmWgQ0kFvUH 37drjrA7ewMd5sWngn02iZvcQ16HR3KAmEaTDWVm/jr7PaZ85jnT5GB7N3QXYOTEZoFdY+ckxYw gLSS6oGivt5ehpi9DR9c6922Vh0yu73lwzD5W7ceoM9VT7T0J995km6KOQjJwZm+dxML/bCQ27R x7g8PpE0BWsGYnazW1XbetWhKyq8Ynmf+tI1rUDdZRbFoVtUuEho2EpOK+jmRxGkLUn3zgjnjws RM8iAnnQIB0KL12Q1P0AnwgXtUiu48QzLiGFeqyC9ifB9EINVs5l1S3od0s3L0apf/RtVFiksbK njIMbvV3i2mGJJavFBCtwf/+u+EZxc5Z/7pEFzApeejLvdZMKG/RmO6nfGr6LAJ9uR/Uq6CY9EB mJ5+evLTw== X-Received: by 2002:a17:902:fd90:b0:2c8:248a:5dbb with SMTP id d9443c01a7336-2d3b0d16339mr129547175ad.7.1786772445466; Fri, 14 Aug 2026 22:40:45 -0700 (PDT) Received: from Default ([2409:40f4:103d:c2fd:25e5:83d3:7385:6296]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-320d5bd9fd3sm11025097eec.4.2026.08.14.22.40.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 22:40:44 -0700 (PDT) From: Jeffin Philip To: gregkh@linuxfoundation.org Cc: jeffinphilip14@gmail.com, victor.krawiec@arturia.com, fanwu01@zju.edu.cn, christophe.jaillet@wanadoo.fr, kees@kernel.org, balbi@kernel.org, tiwai@suse.de, dave@stgolabs.net, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: f_midi: initialize work in f_midi_alloc() Date: Sat, 15 Aug 2026 11:10:06 +0530 Message-ID: <20260815054006.102325-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" f_midi_alloc initializes free_ref to 1 and it can only be incremented when a sound card is registered via f_midi_register_card(). f_midi_register_card() is only called in f_midi_bind() which actually performs INIT_WORK. If f_midi_bind() is never run, work is not initialized and the if condition in f_midi_free becomes true, this results in a warning later in __flush_work as work->func =3D 0. Fix this by moving INIT_WORK from f_midi_bind() to f_midi_alloc(). Reported-by: syzbot+d5fa3d224505c8610702@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dd5fa3d224505c8610702 Fixes: 8653d71ce376 ("usb/gadget: f_midi: Replace tasklet with work") Cc: stable@vger.kernel.org Signed-off-by: Jeffin Philip Reviewed-by: Takashi Iwai --- drivers/usb/gadget/function/f_midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/func= tion/f_midi.c index fba8cf787d6c..63fb6ee70a3d 100644 --- a/drivers/usb/gadget/function/f_midi.c +++ b/drivers/usb/gadget/function/f_midi.c @@ -879,7 +879,6 @@ static int f_midi_bind(struct usb_configuration *c, str= uct usb_function *f) int status, n, jack =3D 1, i =3D 0, endpoint_descriptor_index =3D 0; =20 midi->gadget =3D cdev->gadget; - INIT_WORK(&midi->work, f_midi_in_work); status =3D f_midi_register_card(midi); if (status < 0) goto fail_register; @@ -1377,6 +1376,7 @@ static struct usb_function *f_midi_alloc(struct usb_f= unction_instance *fi) status =3D -ENOMEM; goto midi_free; } + INIT_WORK(&midi->work, f_midi_in_work); midi->out_ports =3D opts->out_ports; midi->index =3D opts->index; midi->buflen =3D opts->buflen; --=20 2.55.0