usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.

A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().

The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.

Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues

Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 92c883440e02cd3733e6df064337127ea47dac1e..f7be1548cc18a4c148f648f77cc1c4fe1971de38 100644 (file)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2418,7 +2418,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
        ep = func->eps;
        epfile = ffs->epfiles;
        count = ffs->eps_count;
-       while(count--) {
+       if (!epfile) {
+               ret = -ENOMEM;
+               goto done;
+       }
+
+       while (count--) {
                ep->ep->driver_data = ep;
 
                ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
@@ -2442,6 +2447,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
        }
 
        wake_up_interruptible(&ffs->wait);
+done:
        spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 
        return ret;