From 5b5b683cb73ff448c96e58b45c55e8459d3dff38 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 15:17:16 +0200 Subject: [PATCH] 6.12-stable patches added patches: usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch --- queue-6.12/series | 1 + ...rly-to-fix-endpoint-direction-checks.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch diff --git a/queue-6.12/series b/queue-6.12/series index 6eebf88474..ffac10d998 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -346,3 +346,4 @@ rdma-siw-bound-read-response-placement-to-the-rread-length.patch fuse-fix-device-node-leak-in-cuse_process_init_reply.patch fuse-re-lock-request-before-returning-from-fuse_ref_folio.patch fuse-clear-intr_entry-in-fuse_resend-and-fuse_remove_pending_req.patch +usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch diff --git a/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch b/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch new file mode 100644 index 0000000000..dc43a0367f --- /dev/null +++ b/queue-6.12/usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch @@ -0,0 +1,47 @@ +From 82cfd4739011bdc7e87b5d585703427e89ddfaa5 Mon Sep 17 00:00:00 2001 +From: Neill Kapron +Date: Fri, 19 Jun 2026 04:06:03 +0000 +Subject: usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks + +From: Neill Kapron + +commit 82cfd4739011bdc7e87b5d585703427e89ddfaa5 upstream. + +When parsing endpoint descriptors, ffs_data_got_descs() generates the +eps_addrmap which contains the endpoint direction. However, epfile->in +was previously only populated in ffs_func_eps_enable() which executes +upon USB host connection. As a result, early userspace ioctls like +FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see +epfile->in as 0, leading to incorrect DMA directions. + +By moving the initialization to ffs_epfiles_create(), epfile->in is +accurate before userspace opens the endpoint files. + +Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface") +Cc: stable +Assisted-by: Antigravity:gemini-3.1-pro +Signed-off-by: Neill Kapron +Link: https://patch.msgid.link/20260619040609.4010746-2-nkapron@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2364,6 +2364,7 @@ static int ffs_epfiles_create(struct ffs + sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]); + else + sprintf(epfile->name, "ep%u", i); ++ epfile->in = (ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ? 1 : 0; + epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name, + epfile, + &ffs_epfile_operations); +@@ -2451,7 +2452,6 @@ static int ffs_func_eps_enable(struct ff + ret = usb_ep_enable(ep->ep); + if (!ret) { + epfile->ep = ep; +- epfile->in = usb_endpoint_dir_in(ep->ep->desc); + epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc); + } else { + break; -- 2.47.3