diff options
authorWesley Cheng <>2021-05-21 17:44:21 -0700
committerGreg Kroah-Hartman <>2021-06-04 13:40:46 +0200
commit6fc1db5e6211e30fbb1cee8d7925d79d4ed2ae14 (patch)
parent024236abeba8194c23affedaaa8b1aee7b943890 (diff)
usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind
During unbind, ffs_func_eps_disable() will be executed, resulting in completion callbacks for any pending USB requests. When using AIO, irrespective of the completion status, io_data work is queued to io_completion_wq to evaluate and handle the completed requests. Since work runs asynchronously to the unbind() routine, there can be a scenario where the work runs after the USB gadget has been fully removed, resulting in accessing of a resource which has been already freed. (i.e. usb_ep_free_request() accessing the USB ep structure) Explicitly drain the io_completion_wq, instead of relying on the destroy_workqueue() (in ffs_data_put()) to make sure no pending completion work items are running. Signed-off-by: Wesley Cheng <> Cc: stable <> Link: Signed-off-by: Greg Kroah-Hartman <>
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index bf109191659a..d4844afeaffc 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3567,6 +3567,9 @@ static void ffs_func_unbind(struct usb_configuration *c,
ffs->func = NULL;
+ /* Drain any pending AIO completions */
+ drain_workqueue(ffs->io_completion_wq);
if (!--opts->refcnt)