From: Triet Hoang <triet.hoang.dev@gmail.com>
To: Pawel Laszczak <pawell@cadence.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
Triet Hoang <triet.hoang.dev@gmail.com>
Subject: [PATCH] usb: cdns2: Handle ZLP request allocation failure
Date: Mon, 17 Aug 2026 15:19:03 +0000 [thread overview]
Message-ID: <20260817151903.188692-1-triet.hoang.dev@gmail.com> (raw)
Check the return value of cdns2_gadget_ep_alloc_request() before
dereferencing the returned request.
Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 25 +++++++++++++++------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
index 308d3c468ab1..40c02159ff4d 100644
--- a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
+++ b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
@@ -1696,7 +1696,7 @@ static int cdns2_ep_enqueue(struct cdns2_endpoint *pep,
static int cdns2_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
gfp_t gfp_flags)
{
- struct usb_request *zlp_request;
+ struct usb_request *zlp_request = NULL;
struct cdns2_request *preq;
struct cdns2_endpoint *pep;
struct cdns2_device *pdev;
@@ -1717,21 +1717,32 @@ static int cdns2_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
spin_lock_irqsave(&pdev->lock, flags);
- preq = to_cdns2_request(request);
- ret = cdns2_ep_enqueue(pep, preq, gfp_flags);
-
- if (ret == 0 && request->zero && request->length &&
+ if (request->zero && request->length &&
(request->length % ep->maxpacket == 0)) {
- struct cdns2_request *preq;
-
zlp_request = cdns2_gadget_ep_alloc_request(ep, GFP_ATOMIC);
+ if (!zlp_request) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
zlp_request->buf = pdev->zlp_buf;
zlp_request->length = 0;
+ }
+ preq = to_cdns2_request(request);
+ ret = cdns2_ep_enqueue(pep, preq, gfp_flags);
+ if (ret)
+ goto out;
+
+ if (zlp_request) {
preq = to_cdns2_request(zlp_request);
ret = cdns2_ep_enqueue(pep, preq, gfp_flags);
}
+out:
+ if (ret && zlp_request)
+ cdns2_gadget_ep_free_request(ep, zlp_request);
+
spin_unlock_irqrestore(&pdev->lock, flags);
return ret;
}
--
2.53.0
reply other threads:[~2026-08-17 15:19 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260817151903.188692-1-triet.hoang.dev@gmail.com \
--to=triet.hoang.dev@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=pawell@cadence.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox