From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FF27371D1B for ; Tue, 7 Apr 2026 15:29:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775575794; cv=none; b=euGPqrGHPECfs4ZZ0lnlD7gjbVcxF0am4zYXpFh0e+gBwt5MyFSQh7Bt5HwR1wUqFXGYinRrLtfbqOJCqhH2X9AcS70TYhT20hsGD9qmOcenl+4QRtdLiigctg2cvUaTFyF4apMhVV1vvAiuJmchX8+R+tBlzsotSSxzj7ArSgI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775575794; c=relaxed/simple; bh=3RnNGyl3W4SfwINZjujzKd3JUNRob0/PcDhVBm7Alxc=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=i+xlq/BwrYEwTX3smw2NBX8dQG7TRitfesi2OWjAzHNMGhJgV5yt/yewTjmRX+bXNcx1XZkR7OQCm8i0JqMBXQBD7pX6Rhs+d65vEnuT5nHQMfd2B+xVmLRyH9hgRonOpT9ka/KBO2EdR65iIByPPiQCBr6SfquQnOU+nE59FKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UGIm4He9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="UGIm4He9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80313C19424; Tue, 7 Apr 2026 15:29:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775575793; bh=3RnNGyl3W4SfwINZjujzKd3JUNRob0/PcDhVBm7Alxc=; h=Subject:To:Cc:From:Date:From; b=UGIm4He9JCBQ2fgyDVIfacrXhNTSaR/MzRpPb8lG4SxIpEXy5bWUaxcKvX2gpBHzi xtGbSkFvMipVMqiRNJWHKJiG0kHvTC2Jq7vFFCqu++N0Uv09iwJwWCOGOvjwcdyRTA HW35mfzwb1HeJlIfHVL9mbui41LH997ZwyAYS7Ug= Subject: FAILED: patch "[PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue" failed to apply to 5.10-stable tree To: yongchao.wu@autochips.com,gregkh@linuxfoundation.org,peter.chen@kernel.org,stable@kernel.org Cc: From: Date: Tue, 07 Apr 2026 17:29:51 +0200 Message-ID: <2026040751-calamity-average-fe6d@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 # git commit -s git send-email --to '' --in-reply-to '2026040751-calamity-average-fe6d@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7f6f127b9bc34bed35f56faf7ecb1561d6b39000 Mon Sep 17 00:00:00 2001 From: Yongchao Wu Date: Tue, 31 Mar 2026 08:04:07 +0800 Subject: [PATCH] usb: cdns3: gadget: fix NULL pointer dereference in ep_queue When the gadget endpoint is disabled or not yet configured, the ep->desc pointer can be NULL. This leads to a NULL pointer dereference when __cdns3_gadget_ep_queue() is called, causing a kernel crash. Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the standard return code for unconfigured endpoints. This prevents potential crashes when ep_queue is called on endpoints that are not ready. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Signed-off-by: Yongchao Wu Acked-by: Peter Chen Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index d59a60a16ec7..96d2a4c38b3f 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2589,6 +2589,9 @@ static int __cdns3_gadget_ep_queue(struct usb_ep *ep, struct cdns3_request *priv_req; int ret = 0; + if (!ep->desc) + return -ESHUTDOWN; + request->actual = 0; request->status = -EINPROGRESS; priv_req = to_cdns3_request(request);