When __usbhsf_pkt_get() returns NULL to pkt, no error return code of usbhsf_pkt_handler() is assigned. To fix this bug, ret is assigned with -EINVAL in this case. Reported-by: TOTE Robot <oslab@xxxxxxxxxxxxxxx> Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx> --- drivers/usb/renesas_usbhs/fifo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c index e6fa13701808..b5e7991dc7d9 100644 --- a/drivers/usb/renesas_usbhs/fifo.c +++ b/drivers/usb/renesas_usbhs/fifo.c @@ -160,8 +160,10 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) usbhs_lock(priv, flags); pkt = __usbhsf_pkt_get(pipe); - if (!pkt) + if (!pkt) { + ret = -EINVAL; goto __usbhs_pkt_handler_end; + } switch (type) { case USBHSF_PKT_PREPARE: -- 2.17.1