In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: initialize reset_work at allocation time

ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on
ffs->reset_work when a functionfs instance is unmounted:

	ffs_data_reset(ffs);
	cancel_work_sync(&ffs->reset_work);

However ffs->reset_work is only ever initialized via INIT_WORK() in
ffs_func_set_alt() and ffs_func_disable(), and only on the
FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()
when the instance is mounted with the "no_disconnect" option, so for the
common case (no "no_disconnect", or mounted and unmounted without ever
being deactivated) reset_work is never initialized.

ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not
initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch
it either, so reset_work.func is left NULL. cancel_work_sync() on such a
work then trips the WARN_ON(!work->func) guard in __flush_work():

  WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount
  Call trace:
   __flush_work
   cancel_work_sync
   ffs_fs_kill_sb [usb_f_fs]
   deactivate_locked_super
   deactivate_super
   cleanup_mnt
   __cleanup_mnt
   task_work_run
   exit_to_user_mode_loop
   el0_svc

On older kernels cancel_work_sync() on a zero-initialized work struct was
a silent no-op, which hid the missing initialization.

Initialize reset_work once in ffs_data_new() so it is always valid for
the lifetime of the ffs_data, and drop the now-redundant INIT_WORK()
calls from the two deactivation paths.

https://git.kernel.org/stable/c/0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7

https://git.kernel.org/stable/c/3137b243c93982fe3460335e12f9247739766e10

https://git.kernel.org/stable/c/69faa3779250df14f51d5084f938a99809546e52

https://git.kernel.org/stable/c/7fe895e0a9651518c4fc082487da770ff9c14c7f

https://git.kernel.org/stable/c/ba1867999dbc4085e6d8c52ac5266005b8b2bf07

https://git.kernel.org/stable/c/c36393b0d14e1e9783888f821ffe29381b8f46dc

https://git.kernel.org/stable/c/cb19e54ebe9baf3c3243083ade65c937339ccb7b

https://git.kernel.org/stable/c/d5631081be07f20e764d3cb5c98ac0a1004fba51

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"7fe895e0a9651518c4fc082487da770ff9c14c7f","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"cb19e54ebe9baf3c3243083ade65c937339ccb7b","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"d5631081be07f20e764d3cb5c98ac0a1004fba51","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"c36393b0d14e1e9783888f821ffe29381b8f46dc","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"69faa3779250df14f51d5084f938a99809546e52","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"ba1867999dbc4085e6d8c52ac5266005b8b2bf07","versionType":"git","status":"affected"},{"version":"18d6b32fca3841f7cd9479b4024abd8a9b299281","lessThan":"3137b243c93982fe3460335e12f9247739766e10","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]