Re: [RESEND PATCH 1/1] usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

[Michał Nazarewicz]

On Fri, Sep 18 2026, zjamg wrote:
> From: Yuchao Zhang <ndaugoing@xxxxxxxxx>
>
> Fixes: c559a3534109 ("usb: gadget: f_fs: add ioctl returning ep descriptor")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yuchao Zhang <ndaugoing@xxxxxxxxx>

Acked-by: Michał Nazarewicz <mina86@xxxxxxxxxx>

> ---
>  drivers/usb/gadget/function/f_fs.c | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 43962e05eacf..c64a268e98a4 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1877,8 +1877,9 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
>  		break;
>  	case FUNCTIONFS_ENDPOINT_DESC:
>  	{
> +		const struct usb_endpoint_descriptor *desc;
> +		struct usb_endpoint_descriptor desc1;
>  		int desc_idx;
> -		struct usb_endpoint_descriptor desc1, *desc;
>  
>  		switch (epfile->ffs->gadget->speed) {
>  		case USB_SPEED_SUPER:
> @@ -1892,7 +1893,17 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
>  			desc_idx = 0;
>  		}
>  
> -		desc = epfile->ep->descs[desc_idx];
> +		do {
> +			desc = epfile->ep->descs[desc_idx];
> +		} while (!desc && --desc_idx >= 0);
> +
> +		if (!desc)
> +			desc = epfile->ep->ep->desc;

IIUC, this will never be non-NULL if all the descriptors are NULL.  Then
again, it probably won’t hurt, so dosen’t matter one way or another.

> +		if (!desc) {
> +			ret = -EINVAL;
> +			break;
> +		}
> +
>  		memcpy(&desc1, desc, desc->bLength);
>  
>  		spin_unlock_irq(&epfile->ffs->eps_lock);

-- 
Best regards
ミハウ “𝓶𝓲𝓷𝓪86” ナザレヴィツ
«If at first you don’t succeed, give up skydiving»