* [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
@ 2026-03-28 14:38 yongchao.wu
2026-03-28 16:03 ` Greg Kroah-Hartman
2026-03-29 1:34 ` Yongchao Wu
0 siblings, 2 replies; 4+ messages in thread
From: yongchao.wu @ 2026-03-28 14:38 UTC (permalink / raw)
To: Peter Chen
Cc: Pawel Laszczak, Roger Quadros, Greg Kroah-Hartman, linux-usb,
linux-kernel, yongchao.wu
When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.
Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.
This prevents potential crashes when ep_queue is called on endpoints
that are not ready.
Signed-off-by: yongchao.wu <yongchao.wu@autochips.com>
---
drivers/usb/cdns3/cdns3-gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index d59a60a16..96d2a4c38 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
struct cdns3_request *priv_req;
int ret = 0;
+ if (!ep->desc)
+ return -ESHUTDOWN;
+
request->actual = 0;
request->status = -EINPROGRESS;
priv_req = to_cdns3_request(request);
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
2026-03-28 14:38 [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue yongchao.wu
@ 2026-03-28 16:03 ` Greg Kroah-Hartman
2026-03-29 1:34 ` Yongchao Wu
1 sibling, 0 replies; 4+ messages in thread
From: Greg Kroah-Hartman @ 2026-03-28 16:03 UTC (permalink / raw)
To: yongchao.wu
Cc: Peter Chen, Pawel Laszczak, Roger Quadros, linux-usb,
linux-kernel
On Sat, Mar 28, 2026 at 10:38:42PM +0800, yongchao.wu wrote:
> When the gadget endpoint is disabled or not yet configured, the ep->desc
> pointer can be NULL. This leads to a NULL pointer dereference when
> __cdns3_gadget_ep_queue() is called, causing a kernel crash.
>
> Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
> standard return code for unconfigured endpoints.
>
> This prevents potential crashes when ep_queue is called on endpoints
> that are not ready.
>
> Signed-off-by: yongchao.wu <yongchao.wu@autochips.com>
Please use your name, not your email alias, for the From: and
signed-off-by lines.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
2026-03-28 14:38 [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue yongchao.wu
2026-03-28 16:03 ` Greg Kroah-Hartman
@ 2026-03-29 1:34 ` Yongchao Wu
2026-03-30 9:21 ` Peter Chen (CIX)
1 sibling, 1 reply; 4+ messages in thread
From: Yongchao Wu @ 2026-03-29 1:34 UTC (permalink / raw)
To: Peter Chen
Cc: Pawel Laszczak, Roger Quadros, Greg Kroah-Hartman, linux-usb,
linux-kernel, Yongchao Wu
When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.
Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.
This prevents potential crashes when ep_queue is called on endpoints
that are not ready.
Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
---
drivers/usb/cdns3/cdns3-gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index d59a60a16..96d2a4c38 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
struct cdns3_request *priv_req;
int ret = 0;
+ if (!ep->desc)
+ return -ESHUTDOWN;
+
request->actual = 0;
request->status = -EINPROGRESS;
priv_req = to_cdns3_request(request);
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
2026-03-29 1:34 ` Yongchao Wu
@ 2026-03-30 9:21 ` Peter Chen (CIX)
0 siblings, 0 replies; 4+ messages in thread
From: Peter Chen (CIX) @ 2026-03-30 9:21 UTC (permalink / raw)
To: Yongchao Wu
Cc: Pawel Laszczak, Roger Quadros, Greg Kroah-Hartman, linux-usb,
linux-kernel
On 26-03-29 09:34:04, Yongchao Wu wrote:
> When the gadget endpoint is disabled or not yet configured, the ep->desc
> pointer can be NULL. This leads to a NULL pointer dereference when
> __cdns3_gadget_ep_queue() is called, causing a kernel crash.
>
> Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
> standard return code for unconfigured endpoints.
>
> This prevents potential crashes when ep_queue is called on endpoints
> that are not ready.
>
> Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
Add Fixed-by tag and Cc to stable tree please, others:
Acked-by: Peter Chen <peter.chen@kernel.org>
Peter
> ---
> drivers/usb/cdns3/cdns3-gadget.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index d59a60a16..96d2a4c38 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep,
> struct cdns3_request *priv_req;
> int ret = 0;
>
> + if (!ep->desc)
> + return -ESHUTDOWN;
> +
> request->actual = 0;
> request->status = -EINPROGRESS;
> priv_req = to_cdns3_request(request);
> --
> 2.43.0
>
>
--
Best regards,
Peter
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-30 9:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-28 14:38 [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue yongchao.wu
2026-03-28 16:03 ` Greg Kroah-Hartman
2026-03-29 1:34 ` Yongchao Wu
2026-03-30 9:21 ` Peter Chen (CIX)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox