From 3ce8a0e9115eaa0cdfc142459814b2283cf01785 Mon Sep 17 00:00:00 2001 From: Chance Yang Date: Tue, 26 Aug 2025 11:36:17 +0800 Subject: [PATCH 1/4] fastboot: Fix has-slot command always returning yes for fb_nand The issue was a mismatch in return value conventions between functions: - getvar_get_part_info() expects >= 0 for success - fb_nand_lookup() returns 0 on success, 1 on failure (from mtdparts_init and find_dev_and_part) When partition didn't exist, fb_nand_lookup returned 1, but fastboot_nand_get_part_info passed it directly to getvar_get_part_info, which treated 1 >= 0 as success, causing has-slot to always return yes. Fix by converting positive return values to -ENOENT in fastboot_nand_get_part_info to match the expected error convention. Signed-off-by: Chance Yang Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20250826-master-v2-1-30b787a2f9fd@kneron.us Signed-off-by: Mattijs Korpershoek --- drivers/fastboot/fb_nand.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/fastboot/fb_nand.c b/drivers/fastboot/fb_nand.c index afc64fd5280..6df3917e129 100644 --- a/drivers/fastboot/fb_nand.c +++ b/drivers/fastboot/fb_nand.c @@ -157,8 +157,13 @@ int fastboot_nand_get_part_info(const char *part_name, struct part_info **part_info, char *response) { struct mtd_info *mtd = NULL; + int ret; - return fb_nand_lookup(part_name, &mtd, part_info, response); + ret = fb_nand_lookup(part_name, &mtd, part_info, response); + if (ret) + return -ENOENT; + + return ret; } /** From f58667587243ce652aaa7d0dd6557a2fb2da5020 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 29 Sep 2025 17:25:23 +0100 Subject: [PATCH 2/4] usb: gadget: atmel: Add missing null check Add in the missing null check for udc->driver that is present at other points in the function before it is dereferenced. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Mattijs Korpershoek Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20250929-atmel_usba_udc-v1-1-e1426271e12a@linaro.org Signed-off-by: Mattijs Korpershoek --- drivers/usb/gadget/atmel_usba_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c index 72f68dba3a7..f7a92ded6da 100644 --- a/drivers/usb/gadget/atmel_usba_udc.c +++ b/drivers/usb/gadget/atmel_usba_udc.c @@ -1147,7 +1147,7 @@ static int usba_udc_irq(struct usba_udc *udc) reset_all_endpoints(udc); if (udc->gadget.speed != USB_SPEED_UNKNOWN && - udc->driver->disconnect) { + udc->driver && udc->driver->disconnect) { udc->gadget.speed = USB_SPEED_UNKNOWN; spin_unlock(&udc->lock); udc->driver->disconnect(&udc->gadget); From 5ac61383b2db15b037e87bd353f726eafc49e181 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 29 Sep 2025 17:40:43 +0100 Subject: [PATCH 3/4] usb: dwc2: Add missing null check Add in the missing null check for dev->driver that is present at other points in the function before it is dereferenced. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Mattijs Korpershoek Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20250929-usb_dwc2-v1-1-863133dcbcde@linaro.org Signed-off-by: Mattijs Korpershoek --- drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c b/drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c index fca052b4556..5a7f50ebaa5 100644 --- a/drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c +++ b/drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c @@ -526,7 +526,7 @@ static int dwc2_udc_irq(int irq, void *_dev) if (gotgint & GOTGINT_SES_END_DET) { debug_cond(DEBUG_ISR, "\t\tSession End Detected\n"); /* Let gadget detect disconnected state */ - if (dev->driver->disconnect) { + if (dev->driver && dev->driver->disconnect) { spin_unlock_irqrestore(&dev->lock, flags); dev->driver->disconnect(&dev->gadget); spin_lock_irqsave(&dev->lock, flags); From 8cd4a5e94ba2ab73fde3301d6314549dd5a25cb4 Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Mon, 29 Sep 2025 10:11:57 +0100 Subject: [PATCH 4/4] usb: dwc3: Remove redundant test In dwc3_ep0_complete_data there is a test for 'r' being null and the code will return at that point if so. After that point 'r' is guaranteed to not be null and testing for that is redundant. Remove the test for 'r' being non-null. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Mattijs Korpershoek Reviewed-by: Marek Vasut Link: https://lore.kernel.org/r/20250929-dwc3_ep0-v1-1-1d5c58933bde@linaro.org Signed-off-by: Mattijs Korpershoek --- drivers/usb/dwc3/ep0.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index c656cbe25ce..680756532f0 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -799,10 +799,7 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, status = DWC3_TRB_SIZE_TRBSTS(trb->size); if (status == DWC3_TRBSTS_SETUP_PENDING) { dev_dbg(dwc->dev, "Setup Pending received"); - - if (r) - dwc3_gadget_giveback(ep0, r, -ECONNRESET); - + dwc3_gadget_giveback(ep0, r, -ECONNRESET); return; }