3 files changed, 21 insertions, 4 deletions

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 08048613eed6..db49ec4c748e 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -441,6 +441,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         kbuf = memdup_user(buf, len);
         if (IS_ERR(kbuf)) {
                 value = PTR_ERR(kbuf);
+                kbuf = NULL;
                 goto free1;
         }
 
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 93328ea7eb1b..9f93bed42052 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 {
         struct usba_ep *ep = to_usba_ep(_ep);
         struct usba_udc *udc = ep->udc;
-        struct usba_request *req = to_usba_req(_req);
+        struct usba_request *req;
         unsigned long flags;
         u32 status;
 
@@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
         spin_lock_irqsave(&udc->lock, flags);
 
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+
+        if (&req->req != _req) {
+                spin_unlock_irqrestore(&udc->lock, flags);
+                return -EINVAL;
+        }
+
         if (req->using_dma) {
                 /*
                  * If this request is currently being transferred,
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 353c686498d4..ccfdfb24b240 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -59,6 +59,9 @@ static struct usb_phy *__of_usb_find_phy(struct device_node *node)
 {
         struct usb_phy  *phy;
 
+        if (!of_device_is_available(node))
+                return ERR_PTR(-ENODEV);
+
         list_for_each_entry(phy, &phy_list, head) {
                 if (node != phy->dev->of_node)
                         continue;
@@ -190,10 +193,13 @@ struct usb_phy *devm_usb_get_phy_by_phandle(struct device *dev,
         spin_lock_irqsave(&phy_lock, flags);
 
         phy = __of_usb_find_phy(node);
-        if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
-                if (!IS_ERR(phy))
-                        phy = ERR_PTR(-ENODEV);
+        if (IS_ERR(phy)) {
+                devres_free(ptr);
+                goto err1;
+        }
 
+        if (!try_module_get(phy->dev->driver->owner)) {
+                phy = ERR_PTR(-ENODEV);
                 devres_free(ptr);
                 goto err1;
         }