Commit cfd6f1a7 authored Sep 15, 2025 by Owen Gu Committed by Greg Kroah-Hartman Sep 17, 2025

usb: gadget: f_fs: Fix epfile null pointer access after ep enable.



A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().

The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.

Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues

Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 45fe729b

drivers/usb/gadget/function/f_fs.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -2407,6 +2407,11 @@ static int ffs_func_eps_enable(struct ffs_function *func)
		ep = func->eps;
		epfile = ffs->epfiles;
		count = ffs->eps_count;
		if (!epfile) {
		ret = -ENOMEM;
		goto done;
		}

		while (count--) {
		ep->ep->driver_data = ep;

		@@ -2431,6 +2436,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
		}

		wake_up_interruptible(&ffs->wait);
		done:
		spin_unlock_irqrestore(&func->ffs->eps_lock, flags);

		return ret;