]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
authorOwen Gu <guhuinan@xiaomi.com>
Mon, 15 Sep 2025 09:29:07 +0000 (17:29 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Sep 2025 10:42:47 +0000 (12:42 +0200)
commitcfd6f1a7b42f62523c96d9703ef32b0dbc495ba4
treedb7cc6ca9077a42195981876d6b4e223ca1629c7
parent45fe729be9a6be326a1ca25af82d34de32ba2ce8
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().

The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.

Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues

Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/f_fs.c