usb: f_fs: Avoid use-after-free of epfile

Consider a case where ffs_func_eps_disable is called from
ffs_func_disable as part of composition switch and at the
same time ffs_epfile_release get called from userspace.

ffs_epfile_release will free up the read buffer and call
ffs_data_closed which in turn destroys ffs->epfiles and
mark it as NULL. While this was happening the driver has
already initialized the local epfile in ffs_func_eps_disable
which is now freed and waiting to acquire the spinlock. Once
spinlock is acquired the driver proceeds with the stale value
of epfile and tries to free the already freed read buffer
casuing use-after-free.

Fix this race by assigning epfile under spin_lock from
ffs_func_eps_disable.

Change-Id: I9e1f376bb2212e8a8040f884514342c428098bdd
Signed-off-by: Pratham Pratap <prathampratap@codeaurora.org>