From e84caed6e7f58d96ea2e4aaa0b947ab05faa451b Mon Sep 17 00:00:00 2001 From: Keisuke Tsukuda Date: Tue, 8 Sep 2026 20:33:54 +0000 Subject: usb: gadget: f_mass_storage: ignore class requests while inactive SET_CONFIGURATION is handled asynchronously by the mass-storage thread. A class request can arrive after the composite core selects the function but before the thread installs common->fsg, or while the function is being disabled. fsg_setup() already rejects this state with -EOPNOTSUPP, but checking it through fsg_is_set() also emits a warning. Check the active function directly so normal requests during a configuration transition are rejected without hiding fsg_is_set() warnings from other internal paths. Fixes: 8876f5e7d3b2 ("USB: gadget: f_mass_storage: added eject callback") Reported-by: syzbot+d31109047baed8f3b590@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d31109047baed8f3b590 Signed-off-by: Keisuke Tsukuda Acked-by: Alan Stern Link: https://patch.msgid.link/20260908203348.95825-3-tkdkei@outlook.jp Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_mass_storage.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c index fc4818fb2a8b..42fd2d6ffd88 100644 --- a/drivers/usb/gadget/function/f_mass_storage.c +++ b/drivers/usb/gadget/function/f_mass_storage.c @@ -463,7 +463,12 @@ static int fsg_setup(struct usb_function *f, u16 w_value = le16_to_cpu(ctrl->wValue); u16 w_length = le16_to_cpu(ctrl->wLength); - if (!fsg_is_set(fsg->common)) + /* + * fsg_is_set() warns when common->fsg is NULL, but that can happen + * normally while a configuration change installs or removes the active + * function. + */ + if (!fsg->common->fsg) return -EOPNOTSUPP; ++fsg->common->ep0_req_tag; /* Record arrival of a new request */ -- cgit v1.2.3