diff options
| author | Haoxiang Li <haoxiang_li2024@163.com> | 2026-06-20 20:06:31 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-10 15:14:28 +0200 |
| commit | 612551bf7cf7113b8bbd5e8c1eea86d9427c2f95 (patch) | |
| tree | 84cb2cc6e90a49f67c697732c538c3e0e91beb4b | |
| parent | dd9483726d0f16c1a56879c3edb65128259a4e2b (diff) | |
| download | linux-next-612551bf7cf7113b8bbd5e8c1eea86d9427c2f95.tar.gz linux-next-612551bf7cf7113b8bbd5e8c1eea86d9427c2f95.zip | |
usb: fsl_qe_udc: check qe_alloc_request() failure in ch9getstatus()
qe_alloc_request() may return NULL on allocation failure. ch9getstatus()
passes the return value directly to container_of() and then immediately
dereferences the resulting qe_req pointer. Check the allocation result
before using it and stall the control request on failure.
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260620120631.2894977-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/udc/fsl_qe_udc.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c index bf87285ad13c..603c77ff129f 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c @@ -1945,6 +1945,7 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, u16 index, u16 length) { u16 usb_status = 0; + struct usb_request *usb_req; struct qe_req *req; struct qe_ep *ep; int status = 0; @@ -1983,8 +1984,11 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, } } - req = container_of(qe_alloc_request(&ep->ep, GFP_KERNEL), - struct qe_req, req); + usb_req = qe_alloc_request(&ep->ep, GFP_KERNEL); + if (!usb_req) + goto stall; + + req = container_of(usb_req, struct qe_req, req); req->req.length = 2; req->req.buf = udc->statusbuf; *(u16 *)req->req.buf = cpu_to_le16(usb_status); |