diff options
| author | Keisuke Tsukuda <catnyaaan@outlook.com> | 2026-09-08 20:33:54 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-10 15:42:25 +0200 |
| commit | e84caed6e7f58d96ea2e4aaa0b947ab05faa451b (patch) | |
| tree | 1f984f493efca5ff1c83a4ef9c68e8ff94e38369 | |
| parent | 048884b782b137229399b9f727b6437d9b4f1071 (diff) | |
| download | linux-next-e84caed6e7f58d96ea2e4aaa0b947ab05faa451b.tar.gz linux-next-e84caed6e7f58d96ea2e4aaa0b947ab05faa451b.zip | |
usb: gadget: f_mass_storage: ignore class requests while inactive
SET_CONFIGURATION is handled asynchronously by the mass-storage thread.
A class request can arrive after the composite core selects the function
but before the thread installs common->fsg, or while the function is being
disabled.
fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it
through fsg_is_set() also emits a warning. Check the active function
directly so normal requests during a configuration transition are rejected
without hiding fsg_is_set() warnings from other internal paths.
Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback")
Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590
Signed-off-by: Keisuke Tsukuda <tkdkei@outlook.jp>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260908203348.95825-3-tkdkei@outlook.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/function/f_mass_storage.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c index fc4818fb2a8b..42fd2d6ffd88 100644 --- a/drivers/usb/gadget/function/f_mass_storage.c +++ b/drivers/usb/gadget/function/f_mass_storage.c @@ -463,7 +463,12 @@ static int fsg_setup(struct usb_function *f, u16 w_value = le16_to_cpu(ctrl->wValue); u16 w_length = le16_to_cpu(ctrl->wLength); - if (!fsg_is_set(fsg->common)) + /* + * fsg_is_set() warns when common->fsg is NULL, but that can happen + * normally while a configuration change installs or removes the active + * function. + */ + if (!fsg->common->fsg) return -EOPNOTSUPP; ++fsg->common->ep0_req_tag; /* Record arrival of a new request */ |