1 files changed, 15 insertions, 4 deletions

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3de65ea6531a..453244805c52 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1929,7 +1929,7 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                    " value=0x%04x index=0x%04x size=%d\n",
                    cmd, reqtype, value, index, size);
 
-        if (data) {
+        if (size) {
                 buf = kmalloc(size, GFP_KERNEL);
                 if (!buf)
                         goto out;
@@ -1938,8 +1938,13 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
         err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
                               USB_CTRL_GET_TIMEOUT);
-        if (err > 0 && err <= size)
-                memcpy(data, buf, err);
+        if (err > 0 && err <= size) {
+        if (data)
+            memcpy(data, buf, err);
+        else
+            netdev_dbg(dev->net,
+                "Huh? Data requested but thrown away.\n");
+    }
         kfree(buf);
 out:
         return err;
@@ -1960,7 +1965,13 @@ static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                 buf = kmemdup(data, size, GFP_KERNEL);
                 if (!buf)
                         goto out;
-        }
+        } else {
+        if (size) {
+            WARN_ON_ONCE(1);
+            err = -EINVAL;
+            goto out;
+        }
+    }
 
         err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,