Re: [PATCH 6.12.y] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Nov 04, 2025 at 11:49:46AM +0800, guhuinan wrote:
> From: Owen Gu <guhuinan@xiaomi.com>
> 
> [ Upstream commit cfd6f1a7b42f ("usb: gadget: f_fs: Fix epfile null
> pointer access after ep enable.") ]
> 
> A race condition occurs when ffs_func_eps_enable() runs concurrently
> with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
> sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
> to a NULL pointer dereference when accessing epfile->ep in
> ffs_func_eps_enable() after successful usb_ep_enable().
> 
> The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
> ffs_data_close() functions, and its modification is protected by the
> spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
> is also protected by ffs->eps_lock.
> 
> Thus, add NULL pointer handling for ffs->epfiles in the
> ffs_func_eps_enable() function to fix issues
> 
> Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
> Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  drivers/usb/gadget/function/f_fs.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

What about 6.17.y?  You do not want to upgrade from 6.12 to a newer
kernel and have a regression.

And if this fixes a bug, why was it not marked with a Fixes: tag or a
 cc: stable tag?  Did I just miss that before?

thanks,

greg k-h