From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2658B3A784A for ; Mon, 17 Aug 2026 09:03:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786957408; cv=none; b=HAGmSUeloupRBZDfTPeYDnU7xW1WPDmWrA8N+kbazXGaMML14sKgQVSWAdrNBXf++DoY9ZogIXtEINI2rEYDGKUYNAbcy0l5vjtLWpsnd8U6CKHNEKJfTeUaIsetRahjWD1l/de6BjLGawJT/oIACTi9DAiF7yag3MnCLZ4v3C0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786957408; c=relaxed/simple; bh=Gsm78FdDURTwGEtRi7PbbtQblZGO/rlLl2zrSxlPekU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GlGXkl3Fs10Qh13UwXmCnG4rySx49Jeiu/orQyAqjtb0qll6oBqOwiH91bPCS7k0ocDvtU/mxCb+H8RQpoMBRkByN85LtkHTqBPtSDNOrpSpprMS0svmyFCaBczZVFTCwTMU0swx4Ito4tgw6KZZf1Fl60eA3yyQC1VK05NKpGw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jx/Dj8F3; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jx/Dj8F3" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38e041ea211so3038162a91.0 for ; Mon, 17 Aug 2026 02:03:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786957406; x=1787562206; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Qup8wHSqTNWqZ291WX414Vh9WOIqgyCwHVdx/0J522I=; b=jx/Dj8F3i4EJeTQAc7SKCmYD1UuFLCPviJJparV1aQqVbxqTwHtDKKq0mP+drL64KE 0l85dWI73etSaxNbtoyyxrB36YcQzA2NmUGvdmA9XgjlX8/KWPmZ8XxNRF5wxX7ejOSc 3sBNTlxzW0w6bUWOeA8mz4zaZrq0m3JvexXJ0MlIGyX10w0Zwog8gs1a0HjkAVGhadhJ w3RkoQX0gQ/CQj+3UCVSNhHHQhbF0Og0ImghWjPzwM7eKSwkCGmP2bQO8T7vlii58D+S MR9IiVIFix2qGpMBRFQxkqmyrvEj9aafUeujO1tTkT6NFFPZ4o7K2DOQMpdAvbK2i9IF 5x0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786957406; x=1787562206; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Qup8wHSqTNWqZ291WX414Vh9WOIqgyCwHVdx/0J522I=; b=gInTI8t9E57FL0R/w0HBaZJo36puU5rvx2mkJBAtWLotzp7WlMRBhivr4lRRUsavtM dRv1mu7nsthLFpsKNHLRS4BU4Cfc03Id95D0B79J8kRwIN5zwGYWOWW5huNQuZvRT5Ps f71XnrHAQCBcUy0a3W9/EAJjegoB1YykJ5vTDktL/Y+V/uKoALrK6AFNictR2jYZKd4b CPm2dYyUY3PO0kmFXumH9f+7Od0yYAah4TcgeJNgjMfXujAI+qe0Y+6luuv4sWWHbwDr ZbODVkJI0ZnocX2m4CsEEPY6i4zmIg4uOV4xcidhQbwcFFgobCwRdr23+w4UzXABTwWO cigA== X-Forwarded-Encrypted: i=1; AHgh+RrqK/U9cCuf5/BFElbzktzdQHMUGj+19ljHbWt6mzjxBzm/v7r3uRDPqe0xnu5ZJgvUkFoO10e7fi0izoA=@vger.kernel.org X-Gm-Message-State: AOJu0YxcMn8hKdEZdTR+xb3PLvjpzfmz2/uJ/epQCfxjOJ8h+ik6sl8M GpTyPqEkGxI2rQq4QGDp7QO0ySF8BBAYsrdz5RW2uyJFExw5hsST6b8= X-Gm-Gg: AR+sD11CGDPu56kiNV9jhyuokwg1txBIC2T9OE8PrkTlucAkzz3lJKAEMxmFICcJSAU BqS9GQD4oKTMeHI1P18XcBtwyqN4R+OX5UMLzN1scXFtxjdEHeObi65190vi4f4tt6dT5owj7ea fKyK42fzWMwanOMRAVSKBNVF93O7MUp6qs3i2v1ndDOdaB/1kbTB9LhwppjNd03KkfcHnpw8LlH LFRaZcwx14fP50zM6sQLzMkKOUp29OLdpUUuiAijBQ/QEfE/17Y7ZzFTGHn/B4LunYcYRkj4q8/ APgSEt8ihKJ5Kk/8J+coKMbjP5XN+NfaNok8Jv4Pm6KYKCYiJjzob27WfNQPdl9wbcCr1jDTYZ3 ahegQoIA3znSp48EQIlnnAe+Vd5C79HN8mnnDWm33JTKBgWpQ3STBxMx/hzEEqwi/GdsUmXyNUr dvGB7p1km1fFc5Nm/VKGriG7Xtb7lr0eLlSMMquhW97olE/YEX3ewdHQzRJTk= X-Received: by 2002:a17:90b:3889:b0:381:11eb:d78e with SMTP id 98e67ed59e1d1-3933b8ace11mr21789029a91.14.1786957406258; Mon, 17 Aug 2026 02:03:26 -0700 (PDT) Received: from DL2XHKPB4.dl.net ([103.63.104.162]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3933b68adefsm4614751a91.3.2026.08.17.02.03.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 02:03:25 -0700 (PDT) From: Triet Hoang To: peter.chen@kernel.org Cc: pawell@cadence.com, rogerq@kernel.org, gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Triet Hoang Subject: [PATCH v2] usb: cdns3: Handle ZLP request allocation failure Date: Mon, 17 Aug 2026 16:03:20 +0700 Message-ID: <20260817090321.955841-1-triet.hoang.dev@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260817075929.899795-1-triet.hoang.dev@gmail.com> References: <20260817075929.899795-1-triet.hoang.dev@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Check the return value of cdns3_gadget_ep_alloc_request() before dereferencing the returned request. Changes in v2: - Allocate the ZLP request before queuing the primary request. - Free the allocated ZLP request when the primary request queueing fails. Signed-off-by: Triet Hoang --- drivers/usb/cdns3/cdns3-gadget.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index 42311c1bfada..05d225f99012 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2641,7 +2641,7 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep, static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, gfp_t gfp_flags) { - struct usb_request *zlp_request; + struct usb_request *zlp_request = NULL; struct cdns3_endpoint *priv_ep; struct cdns3_device *priv_dev; unsigned long flags; @@ -2655,24 +2655,36 @@ static int cdns3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, spin_lock_irqsave(&priv_dev->lock, flags); - ret = __cdns3_gadget_ep_queue(ep, request, gfp_flags); - - if (ret == 0 && request->zero && request->length && + if (request->zero && request->length && (request->length % ep->maxpacket == 0)) { struct cdns3_request *priv_req; zlp_request = cdns3_gadget_ep_alloc_request(ep, GFP_ATOMIC); + if (!zlp_request) { + ret = -ENOMEM; + goto out; + } + zlp_request->buf = priv_dev->zlp_buf; zlp_request->length = 0; priv_req = to_cdns3_request(zlp_request); priv_req->flags |= REQUEST_ZLP; + } + + ret = __cdns3_gadget_ep_queue(ep, request, gfp_flags); + if (ret) + goto out; + if (zlp_request) { dev_dbg(priv_dev->dev, "Queuing ZLP for endpoint: %s\n", priv_ep->name); ret = __cdns3_gadget_ep_queue(ep, zlp_request, gfp_flags); } +out: + if (ret && zlp_request) + cdns3_gadget_ep_free_request(ep, zlp_request); spin_unlock_irqrestore(&priv_dev->lock, flags); return ret; } -- 2.53.0