[PATCH v2] usb: gadget: udc-xilinx: guard EP0 dequeue against empty queue

[PATCH v2] usb: gadget: udc-xilinx: guard EP0 dequeue against empty queue

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

The EP0 dequeue side, xudc_ep0_out() and xudc_ep0_in(), calls
list_first_entry() on ep0->queue without checking whether a request is
queued, while the enqueue side __xudc_ep0_queue() already guards the
same queue with list_empty() and the non-control endpoint handler
performs the same check before its own list_first_entry().

list_first_entry() never returns NULL on an empty list; it returns the
container_of() of the list head, i.e. a non-NULL wild pointer into the
enclosing struct xusb_ep. Switch both functions to
list_first_entry_or_null() and return early when no request is queued,
making the dequeue side consistent with the rest of the driver.

This is a defensive consistency fix found by static analysis.

Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Reviewed-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
v1: https://lore.kernel.org/r/20261023073131.637062-1-lixicaicai@gmail.com
v2: refactor the commit description as a defensive consistency fix per
Suhan's review (the originally described bus-timing trigger is not
reachable without software first arming a buffer), and add the Fixes
tag. Carry Aldo's Reviewed-by. No code change.

 drivers/usb/gadget/udc/udc-xilinx.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
index bef06fe75..032d9f04f 100644
--- a/drivers/usb/gadget/udc/udc-xilinx.c
+++ b/drivers/usb/gadget/udc/udc-xilinx.c
@@ -1822,7 +1822,9 @@ static void xudc_ep0_out(struct xusb_udc *udc)
 	unsigned int bytes_to_rx;
 	void *buffer;
 
-	req = list_first_entry(&ep0->queue, struct xusb_req, queue);
+	req = list_first_entry_or_null(&ep0->queue, struct xusb_req, queue);
+	if (!req)
+		return;
 
 	switch (udc->setupseqrx) {
 	case STATUS_PHASE:
@@ -1875,7 +1877,10 @@ static void xudc_ep0_in(struct xusb_udc *udc)
 	u8 *ep0rambase;
 	u8 test_mode = le16_to_cpu(udc->setup.wIndex) >> 8;
 
-	req = list_first_entry(&ep0->queue, struct xusb_req, queue);
+	req = list_first_entry_or_null(&ep0->queue, struct xusb_req, queue);
+	if (!req)
+		return;
+
 	bytes_to_tx = req->usb_req.length - req->usb_req.actual;
 
 	switch (udc->setupseqtx) {
-- 
2.30.2

Re: [PATCH v2] usb: gadget: udc-xilinx: guard EP0 dequeue against empty queue

[sashiko-bot]

> From: Wang Haoran <haoranwangsec@gmail.com>
> 
> The EP0 dequeue side, xudc_ep0_out() and xudc_ep0_in(), calls
> list_first_entry() on ep0->queue without checking whether a request is
> queued, while the enqueue side __xudc_ep0_queue() already guards the
> same queue with list_empty() and the non-control endpoint handler
> performs the same check before its own list_first_entry().
> 
> list_first_entry() never returns NULL on an empty list; it returns the
> container_of() of the list head, i.e. a non-NULL wild pointer into the
> enclosing struct xusb_ep. Switch both functions to
> list_first_entry_or_null() and return early when no request is queued,
> making the dequeue side consistent with the rest of the driver.
> 
> This is a defensive consistency fix found by static analysis.
> 
> Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Reviewed-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103084722.1821982-1-lixicaicai@gmail.com?part=1