usb: gadget: ffs: race between ffs_epfile_io() and ffs_func_eps_disable()

usb: gadget: ffs: race between ffs_epfile_io() and ffs_func_eps_disable()

ffs_epfile_io() is called from userspace, while ffs_func_eps_disable() might be
called from USB disconnect interrupt, the two functions would run in parallel
but they are not well protected, that epfile->ep would be removed by
ffs_func_eps_disable() during ffs_epfile_io() is referring this pointer, then
it leads to kernel PANIC.

The scenario is as below:

Thread 1                                 Thread 2
   |                                        |
SyS_read                             dwc3_gadget_disconnect_interrupt
   |                                        |
ffs_epfile_read                         reset_config
   |                                        |
ffs_epfile_io                       ffs_func_eps_disable
   |                                        |
 -----                      usb_ep_disable():  epfile->ep->ep->desc = NULL
   |                                        |
usb_ep_align_maybe():                     -----
it refers ep->desc->wMaxPacketSize        -----

Signed-off-by: Chao Bi <chao.bi@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
[backport from upstream commit 97839ca4b06ab27790700ad7da6be9a75fc0cc1d]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-id: I97839ca4b06ab27790700ad7da6be9a75fc0cc1d