Skip to content

usb: gadget: f_fs: fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

zjamg linux-usb lkml stable 2 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v1 Latest posting 2/21 patch 1 replyIn review
  2. v1 posting 1/21 patch 1 replySuperseded

Patches in v1 posting 2/2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/1usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESCdrivers/usb/gadget/function/f_fs.c+13 -21 reply

Reviews trailers per patch

The patch has a Reviewed-by or Acked-by.

PatchMichał Nazarewicz
1/1A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [RESEND PATCH 0/1] usb: gadget: f_fs: fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

From: Yuchao Zhang <[email protected]>

Hi,

This patch addresses a kernel NULL pointer dereference panic in FunctionFS when calling the FUNCTIONFS_ENDPOINT_DESC ioctl.

In FunctionFS, user space can legitimately supply only a subset of speed descriptors (e.g., only full-speed descriptors via FUNCTIONFS_HAS_FS_DESC). When the USB gadget is subsequently connected to a high-speed or super-speed host:
1. composite.c:config_ep_by_speed() detects that the function lacks descriptors for the current speed and gracefully falls back to full-speed descriptors (f->fs_descriptors).
2. The endpoint is enabled via usb_ep_enable(), and epfile->ep becomes valid.
3. However, when user space calls ioctl(fd, FUNCTIONFS_ENDPOINT_DESC), ffs_epfile_ioctl() selects the descriptor index solely based on epfile->ffs->gadget->speed (desc_idx = 1 for HIGH, 2 for SUPER/SUPER_PLUS).
4. Because user space only supplied full-speed descriptors, epfile->ep->descs[desc_idx] is NULL.
5. The subsequent memcpy(&desc1, desc, desc->bLength) immediately dereferences the NULL pointer, causing an instant kernel crash:

[    2.154836] Call trace:
[    2.154836]  ffs_epfile_ioctl+0xe14/0x2c40 [usb_f_fs] (P)
[    2.155003]  __arm64_sys_ioctl+0x128/0x1a4
[    2.155298]  invoke_syscall.constprop.0+0x64/0x260
[    2.155374]  el0_svc_common.constprop.0+0xa0/0x240
[    2.155441]  do_el0_svc+0x3c/0x60
[    2.155494]  el0_svc+0x38/0x98
[    2.155547]  el0t_64_sync_handler+0xa0/0xe4
[    2.155606]  el0t_64_sync+0x198/0x19c
[    2.156463] Kernel panic - not syncing: Oops: Fatal exception

The fix restores the speed fallback loop mirroring config_ep_by_speed() and historical f_fs behavior, defensively checks epfile->ep->ep->desc as a fallback, and returns -EINVAL safely if no valid descriptor is found.

Testing with QEMU ARM64 using dummy_hcd confirms that after applying this patch, the ioctl succeeds and returns the fallback descriptor cleanly without any crash.

zjamg (1):
usb: gadget: f_fs: Fix NULL pointer dereference in
FUNCTIONFS_ENDPOINT_DESC

 drivers/usb/gadget/function/f_fs.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)
Signature · 1 line
2.53.0

Read the cover letter in its thread