github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

usb: fsl_qe_udc: check qe_alloc_request() failure in ch9getstatus()

Browse Source 
qe_alloc_request() may return NULL on allocation failure. ch9getstatus()
passes the return value directly to container_of() and then immediately
dereferences the resulting qe_req pointer. Check the allocation result
before using it and stall the control request on failure.

Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260620120631.2894977-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Haoxiang Li 2026-06-20 20:06:31 +08:00 committed by Greg Kroah-Hartman
parent dd9483726d
commit 612551bf7c
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/usb/gadget/udc/fsl_qe_udc.c
View File

@ -1945,6 +1945,7 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
u16 index, u16 length)
{
u16 usb_status = 0;
struct usb_request *usb_req;
struct qe_req *req;
struct qe_ep *ep;
int status = 0;
@ -1983,8 +1984,11 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
}
}
req = container_of(qe_alloc_request(&ep->ep, GFP_KERNEL),
struct qe_req, req);
usb_req = qe_alloc_request(&ep->ep, GFP_KERNEL);
if (!usb_req)
goto stall;
req = container_of(usb_req, struct qe_req, req);
req->req.length = 2;
req->req.buf = udc->statusbuf;
*(u16 *)req->req.buf = cpu_to_le16(usb_status);