On Tue, Nov 04, 2025 at 02:15:44PM +0900, Greg Kroah-Hartman wrote:
On Tue, Nov 04, 2025 at 11:49:46AM +0800, guhuinan wrote:
From: Owen Gu guhuinan@xiaomi.com
[ Upstream commit cfd6f1a7b42f ("usb: gadget: f_fs: Fix epfile null pointer access after ep enable.") ]
A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and ffs_data_close() functions, and its modification is protected by the spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the ffs_func_eps_enable() function to fix issues
Signed-off-by: Owen Gu guhuinan@xiaomi.com Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
drivers/usb/gadget/function/f_fs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
What about 6.17.y? You do not want to upgrade from 6.12 to a newer kernel and have a regression.
And if this fixes a bug, why was it not marked with a Fixes: tag or a cc: stable tag? Did I just miss that before?
thanks,
greg k-h
Hi Greg KH,
I noticed that the patch for version 6.17.y has already been submitted: https://lore.kernel.org/all/20251025160905.3857885-311-sashal@kernel.org/
I apologize for forgetting to include the 'Fixes' tag in the previous patch submission. Are there any corrective actions available now? The fix reference is: Fixes: ebe2b1add1055 ("usb: f_fs: Fix use-after-free for epfile")"
Thanks, Owen