]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
authorYongchao Wu <yongchao.wu@autochips.com>
Tue, 31 Mar 2026 00:04:07 +0000 (08:04 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 2 Apr 2026 07:30:25 +0000 (09:30 +0200)
commit7f6f127b9bc34bed35f56faf7ecb1561d6b39000
treee40bf7cea2fb71b76b8e887c61c6d85840d8ab01
parent0179c6da0793ae03607002c284b53b6d584172d0
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue

When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.

Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.

This prevents potential crashes when ep_queue is called on endpoints
that are not ready.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Yongchao Wu <yongchao.wu@autochips.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/cdns3/cdns3-gadget.c