[PATCH v2] usb: gadget: udc-xilinx: guard EP0 dequeue against empty queue

[S M, Suhan]

On 11/3/2026 2:17 PM, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec at gmail.com>
> 
> The EP0 dequeue side, xudc_ep0_out() and xudc_ep0_in(), calls
> list_first_entry() on ep0->queue without checking whether a request is
> queued, while the enqueue side __xudc_ep0_queue() already guards the
> same queue with list_empty() and the non-control endpoint handler
> performs the same check before its own list_first_entry().
> 
> list_first_entry() never returns NULL on an empty list; it returns the
> container_of() of the list head, i.e. a non-NULL wild pointer into the
> enclosing struct xusb_ep. Switch both functions to
> list_first_entry_or_null() and return early when no request is queued,
> making the dequeue side consistent with the rest of the driver.
> 
> This is a defensive consistency fix found by static analysis.
> 
> Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
> Reported-by: Wang Haoran <haoranwangsec at gmail.com>
> Reported-by: Li Ximo <lixicaicai at gmail.com>
> Reviewed-by: Aldo Ariel Panzardo <qwe.aldo at gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec at gmail.com>
Reviewed-by: Shaikh Mohammed Suhan <suhansm2 at amd.com>> ---
> v1: https://lore.kernel.org/r/20261023073131.637062-1-lixicaicai@gmail.com
> v2: refactor the commit description as a defensive consistency fix per
> Suhan's review (the originally described bus-timing trigger is not
> reachable without software first arming a buffer), and add the Fixes
> tag. Carry Aldo's Reviewed-by. No code change.
> 
>   drivers/usb/gadget/udc/udc-xilinx.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
> index bef06fe75..032d9f04f 100644
> --- a/drivers/usb/gadget/udc/udc-xilinx.c
> +++ b/drivers/usb/gadget/udc/udc-xilinx.c
> @@ -1822,7 +1822,9 @@ static void xudc_ep0_out(struct xusb_udc *udc)
>   	unsigned int bytes_to_rx;
>   	void *buffer;
>   
> -	req = list_first_entry(&ep0->queue, struct xusb_req, queue);
> +	req = list_first_entry_or_null(&ep0->queue, struct xusb_req, queue);
> +	if (!req)
> +		return;
>   
>   	switch (udc->setupseqrx) {
>   	case STATUS_PHASE:
> @@ -1875,7 +1877,10 @@ static void xudc_ep0_in(struct xusb_udc *udc)
>   	u8 *ep0rambase;
>   	u8 test_mode = le16_to_cpu(udc->setup.wIndex) >> 8;
>   
> -	req = list_first_entry(&ep0->queue, struct xusb_req, queue);
> +	req = list_first_entry_or_null(&ep0->queue, struct xusb_req, queue);
> +	if (!req)
> +		return;
> +
>   	bytes_to_tx = req->usb_req.length - req->usb_req.actual;
>   
>   	switch (udc->setupseqtx) {