6.12-stable patches

added patches:
	usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch

diff --git a/queue-6.12/series b/queue-6.12/series
index 6eebf884746b8a1b8eea416ad62e0eda1a77caad..ffac10d9981df22b82d28aa2be752728470ee2f6 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -346,3 +346,4 @@ rdma-siw-bound-read-response-placement-to-the-rread-length.patch
 fuse-fix-device-node-leak-in-cuse_process_init_reply.patch
 fuse-re-lock-request-before-returning-from-fuse_ref_folio.patch
 fuse-clear-intr_entry-in-fuse_resend-and-fuse_remove_pending_req.patch
+usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch

diff --git a/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch b/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch
new file mode 100644 (file)
index 0000000..dc43a03
--- /dev/null
+++ b/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch
@@ -0,0 +1,47 @@
+From 82cfd4739011bdc7e87b5d585703427e89ddfaa5 Mon Sep 17 00:00:00 2001
+From: Neill Kapron <nkapron@google.com>
+Date: Fri, 19 Jun 2026 04:06:03 +0000
+Subject: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
+
+From: Neill Kapron <nkapron@google.com>
+
+commit 82cfd4739011bdc7e87b5d585703427e89ddfaa5 upstream.
+
+When parsing endpoint descriptors, ffs_data_got_descs() generates the
+eps_addrmap which contains the endpoint direction. However, epfile->in
+was previously only populated in ffs_func_eps_enable() which executes
+upon USB host connection. As a result, early userspace ioctls like
+FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see
+epfile->in as 0, leading to incorrect DMA directions.
+
+By moving the initialization to ffs_epfiles_create(), epfile->in is
+accurate before userspace opens the endpoint files.
+
+Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
+Cc: stable <stable@kernel.org>
+Assisted-by: Antigravity:gemini-3.1-pro
+Signed-off-by: Neill Kapron <nkapron@google.com>
+Link: https://patch.msgid.link/20260619040609.4010746-2-nkapron@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_fs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2364,6 +2364,7 @@ static int ffs_epfiles_create(struct ffs
+                       sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
+               else
+                       sprintf(epfile->name, "ep%u", i);
++              epfile->in = (ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ? 1 : 0;
+               epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name,
+                                                epfile,
+                                                &ffs_epfile_operations);
+@@ -2451,7 +2452,6 @@ static int ffs_func_eps_enable(struct ff
+               ret = usb_ep_enable(ep->ep);
+               if (!ret) {
+                       epfile->ep = ep;
+-                      epfile->in = usb_endpoint_dir_in(ep->ep->desc);
+                       epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
+               } else {
+                       break;