1 files changed, 12 insertions, 4 deletions

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 3507f880eb74..6e7be91e6097 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 
         kiocb->private = p;
 
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
         res = ffs_epfile_io(kiocb->ki_filp, p);
         if (res == -EIOCBQUEUED)
@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 
         kiocb->private = p;
 
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
         res = ffs_epfile_io(kiocb->ki_filp, p);
         if (res == -EIOCBQUEUED)
@@ -3435,6 +3437,7 @@ done:
 static void ffs_closed(struct ffs_data *ffs)
 {
         struct ffs_dev *ffs_obj;
+        struct f_fs_opts *opts;
 
         ENTER();
         ffs_dev_lock();
@@ -3449,8 +3452,13 @@ static void ffs_closed(struct ffs_data *ffs)
             ffs_obj->ffs_closed_callback)
                 ffs_obj->ffs_closed_callback(ffs);
 
-        if (!ffs_obj->opts || ffs_obj->opts->no_configfs
-            || !ffs_obj->opts->func_inst.group.cg_item.ci_parent)
+        if (ffs_obj->opts)
+                opts = ffs_obj->opts;
+        else
+                goto done;
+
+        if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
+            || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
                 goto done;
 
         unregister_gadget_item(ffs_obj->opts->