diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 449594801f0b..e7cb9deb2028 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -848,7 +848,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 			} else if (unlikely(
 				   wait_for_completion_interruptible(&done))) {
 				spin_lock_irq(&epfile->ffs->eps_lock);
-				if (ep->ep)
+				/*
+				 * While we were acquiring lock endpoint got
+				 * disabled (disconnect) or changed
+				 * (composition switch) ?
+				 */
+				if (epfile->ep == ep)
 					usb_ep_dequeue(ep->ep, req);
 				spin_unlock_irq(&epfile->ffs->eps_lock);
 				ret = -EINTR;
@@ -861,7 +866,12 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 				 * data then user space has space for.
 				 */
 				spin_lock_irq(&epfile->ffs->eps_lock);
-				if (ep->ep)
+				/*
+				 * While we were acquiring lock endpoint got
+				 * disabled (disconnect) or changed
+				 * (composition switch) ?
+				 */
+				if (epfile->ep == ep)
 					ret = ep->status;
 				else
 					ret = -ENODEV;
@@ -3268,6 +3278,7 @@ static void ffs_func_unbind(struct usb_configuration *c,
 		if (ep->ep && ep->req)
 			usb_ep_free_request(ep->ep, ep->req);
 		ep->req = NULL;
+		ep->ep = NULL;
 		++ep;
 	} while (--count);
 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);