]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
authorNeill Kapron <nkapron@google.com>
Fri, 19 Jun 2026 04:06:03 +0000 (04:06 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Jun 2026 14:23:51 +0000 (15:23 +0100)
When parsing endpoint descriptors, ffs_data_got_descs() generates the
eps_addrmap which contains the endpoint direction. However, epfile->in
was previously only populated in ffs_func_eps_enable() which executes
upon USB host connection. As a result, early userspace ioctls like
FUNCTIONFS_DMABUF_ATTACH that run before the host connects would see
epfile->in as 0, leading to incorrect DMA directions.

By moving the initialization to ffs_epfiles_create(), epfile->in is
accurate before userspace opens the endpoint files.

Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
Cc: stable <stable@kernel.org>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260619040609.4010746-2-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/f_fs.c

index 745c44d251f7ff4846b3d5c6a5c9dad797b96bc8..d9b95fb830dfe34816d0cbedc3b9b2ed422beae7 100644 (file)
@@ -2367,6 +2367,7 @@ static int ffs_epfiles_create(struct ffs_data *ffs)
                        sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
                else
                        sprintf(epfile->name, "ep%u", i);
+               epfile->in = (ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ? 1 : 0;
                err = ffs_sb_create_file(ffs->sb, epfile->name,
                                         epfile, &ffs_epfile_operations);
                if (err) {
@@ -2456,7 +2457,6 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                ret = usb_ep_enable(ep->ep);
                if (!ret) {
                        epfile->ep = ep;
-                       epfile->in = usb_endpoint_dir_in(ep->ep->desc);
                        epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
                } else {
                        break;