If cdns3_gadget_ep_alloc_request() fails, a null pointer dereference occurs. Add a check to prevent it.
Found by code review and compiled on ubuntu 20.04.
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li lihaoxiang@isrc.iscas.ac.cn --- drivers/usb/cdns3/cdns3-gadget.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index 168707213ed9..cc2421a34588 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2659,6 +2659,8 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, struct cdns3_request *priv_req;
zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC); + if (!zlp_request) + return -ENOMEM; zlp_request->buf = priv_dev->zlp_buf; zlp_request->length = 0;
On Wed, Dec 24, 2025 at 05:29:35PM +0800, Haoxiang Li wrote:
If cdns3_gadget_ep_alloc_request() fails, a null pointer dereference occurs. Add a check to prevent it.
Found by code review and compiled on ubuntu 20.04.
What tool did you use to find this through 'code review'?
And the compile line doesn't help, as I stated before.
And how was this tested?
thanks,
greg k-h
linux-stable-mirror@lists.linaro.org