Re: [PATCH] usb: f_fs-aio-simple: add NULL checks for malloc calls

On Mon, Aug 17, 2026 at 02:27:56PM +0800, longlong yan wrote:
> Add NULL checks for the return values of malloc() in the aio_simple
> FFS example application. If any of the four malloc calls (buf_in,
> buf_out, iocb_in, iocb_out) fails, the subsequent code would
> dereference NULL pointers in the main loop.
> 
> Since free(NULL) is safe, the error path frees all four buffers
> unconditionally, then cleans up the remaining resources (io context,
> endpoint file descriptors) consistent with the existing cleanup at
> the end of the function.
> 
> Signed-off-by: longlong yan <[email protected]>
> ---
>  .../ffs-aio-example/simple/device_app/aio_simple.c  | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/tools/usb/ffs-aio-example/simple/device_app/aio_simple.c b/tools/usb/ffs-aio-example/simple/device_app/aio_simple.c
> index 96616eb4600b..07ca1f136ad7 100644
> --- a/tools/usb/ffs-aio-example/simple/device_app/aio_simple.c
> +++ b/tools/usb/ffs-aio-example/simple/device_app/aio_simple.c
> @@ -294,6 +294,19 @@ int main(int argc, char *argv[])
>  	iocb_in = malloc(sizeof(*iocb_in));
>  	iocb_out = malloc(sizeof(*iocb_out));
>  
> +	if (!buf_in || !buf_out || !iocb_in || !iocb_out) {
> +		perror("malloc");
> +		free(buf_in);
> +		free(buf_out);
> +		free(iocb_in);
> +		free(iocb_out);
> +		io_destroy(ctx);
> +		for (i = 0; i < 2; ++i)
> +			close(ep[i]);
> +		close(ep0);
> +		return 1;
> +	}

It's userspace, why not just return an error and let the kernel clean up
the memory automatically?

Or better yet, just have a goto to jump to the end of the function where
all of this code already lives?

How did you find this problem?  How was it tested?

thanks,

greg k-h