[PATCH 0/1] usb: gadget: f_fs: fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

[zjamg <ndaugoing@gmail.com>]

Hi,

This patch addresses a kernel NULL pointer dereference panic in
FunctionFS when calling the FUNCTIONFS_ENDPOINT_DESC ioctl.

In FunctionFS, user space can legitimately supply only a subset of
speed descriptors (e.g., only full-speed descriptors via
FUNCTIONFS_HAS_FS_DESC). When the USB gadget is subsequently connected
to a high-speed or super-speed host:
1. composite.c:config_ep_by_speed() detects that the function lacks
   descriptors for the current speed and gracefully falls back to
   full-speed descriptors (f->fs_descriptors).
2. The endpoint is enabled via usb_ep_enable(), and epfile->ep becomes
   valid.
3. However, when user space calls ioctl(fd, FUNCTIONFS_ENDPOINT_DESC),
   ffs_epfile_ioctl() selects the descriptor index solely based on
   epfile->ffs->gadget->speed (desc_idx = 1 for HIGH, 2 for
   SUPER/SUPER_PLUS).
4. Because user space only supplied full-speed descriptors,
   epfile->ep->descs[desc_idx] is NULL.
5. The subsequent memcpy(&desc1, desc, desc->bLength) immediately
   dereferences the NULL pointer, causing an instant kernel crash:

[    2.154836] Call trace:
[    2.154836]  ffs_epfile_ioctl+0xe14/0x2c40 [usb_f_fs] (P)
[    2.155003]  __arm64_sys_ioctl+0x128/0x1a4
[    2.155298]  invoke_syscall.constprop.0+0x64/0x260
[    2.155374]  el0_svc_common.constprop.0+0xa0/0x240
[    2.155441]  do_el0_svc+0x3c/0x60
[    2.155494]  el0_svc+0x38/0x98
[    2.155547]  el0t_64_sync_handler+0xa0/0xe4
[    2.155606]  el0t_64_sync+0x198/0x19c
[    2.156463] Kernel panic - not syncing: Oops: Fatal exception

The fix restores the speed fallback loop mirroring config_ep_by_speed()
and historical f_fs behavior, defensively checks epfile->ep->ep->desc
as a fallback, and returns -EINVAL safely if no valid descriptor is
found.

Testing with QEMU ARM64 using dummy_hcd confirms that after applying
this patch, the ioctl succeeds and returns the fallback descriptor
cleanly without any crash.

zjamg (1):
  usb: gadget: f_fs: Fix NULL pointer dereference in
    FUNCTIONFS_ENDPOINT_DESC

 drivers/usb/gadget/function/f_fs.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

-- 
2.53.0