[PATCH 6.12.y] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

[PATCH 6.12.y] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

[guhuinan]

From: Owen Gu <guhuinan@xiaomi.com>

[ Upstream commit cfd6f1a7b42f ("usb: gadget: f_fs: Fix epfile null
pointer access after ep enable.") ]

A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().

The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.

Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues

Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_fs.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 08a251df20c4..04058261cdd0 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2407,7 +2407,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 	ep = func->eps;
 	epfile = ffs->epfiles;
 	count = ffs->eps_count;
-	while(count--) {
+	if (!epfile) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	while (count--) {
 		ep->ep->driver_data = ep;
 
 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
@@ -2431,6 +2436,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 	}
 
 	wake_up_interruptible(&ffs->wait);
+done:
 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 
 	return ret;
-- 
2.43.0

Re: [PATCH 6.12.y] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

[Greg Kroah-Hartman]

On Tue, Nov 04, 2025 at 11:49:46AM +0800, guhuinan wrote:
> From: Owen Gu <guhuinan@xiaomi.com>
> 
> [ Upstream commit cfd6f1a7b42f ("usb: gadget: f_fs: Fix epfile null
> pointer access after ep enable.") ]
> 
> A race condition occurs when ffs_func_eps_enable() runs concurrently
> with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
> sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
> to a NULL pointer dereference when accessing epfile->ep in
> ffs_func_eps_enable() after successful usb_ep_enable().
> 
> The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
> ffs_data_close() functions, and its modification is protected by the
> spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
> is also protected by ffs->eps_lock.
> 
> Thus, add NULL pointer handling for ffs->epfiles in the
> ffs_func_eps_enable() function to fix issues
> 
> Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
> Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  drivers/usb/gadget/function/f_fs.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

What about 6.17.y?  You do not want to upgrade from 6.12 to a newer
kernel and have a regression.

And if this fixes a bug, why was it not marked with a Fixes: tag or a
 cc: stable tag?  Did I just miss that before?

thanks,

greg k-h

Re: [PATCH 6.12.y] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.

[Owen Gu]

On Tue, Nov 04, 2025 at 02:15:44PM +0900, Greg Kroah-Hartman wrote:
> On Tue, Nov 04, 2025 at 11:49:46AM +0800, guhuinan wrote:
> > From: Owen Gu <guhuinan@xiaomi.com>
> > 
> > [ Upstream commit cfd6f1a7b42f ("usb: gadget: f_fs: Fix epfile null
> > pointer access after ep enable.") ]
> > 
> > A race condition occurs when ffs_func_eps_enable() runs concurrently
> > with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
> > sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
> > to a NULL pointer dereference when accessing epfile->ep in
> > ffs_func_eps_enable() after successful usb_ep_enable().
> > 
> > The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
> > ffs_data_close() functions, and its modification is protected by the
> > spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
> > is also protected by ffs->eps_lock.
> > 
> > Thus, add NULL pointer handling for ffs->epfiles in the
> > ffs_func_eps_enable() function to fix issues
> > 
> > Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
> > Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> >  drivers/usb/gadget/function/f_fs.c | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> What about 6.17.y?  You do not want to upgrade from 6.12 to a newer
> kernel and have a regression.
> 
> And if this fixes a bug, why was it not marked with a Fixes: tag or a
>  cc: stable tag?  Did I just miss that before?
> 
> thanks,
> 
> greg k-h
Hi Greg KH,

I noticed that the patch for version 6.17.y has already been submitted:
 https://lore.kernel.org/all/20251025160905.3857885-311-sashal@kernel.org/

I apologize for forgetting to include the 'Fixes' tag in the previous
patch submission. Are there any corrective actions available now?
The fix reference is:
Fixes: ebe2b1add1055 ("usb: f_fs: Fix use-after-free for epfile")"

Thanks,
Owen