3 files changed, 26 insertions, 18 deletions

diff --git a/core/usbd_core.c b/core/usbd_core.c
index a9ad67c4..d88fc5f4 100644
--- a/core/usbd_core.c
+++ b/core/usbd_core.c
@@ -1351,14 +1351,12 @@ int usbd_initialize(uint8_t busid, uintptr_t reg_base, void (*event_handler)(uin
 #ifdef CONFIG_USBDEV_EP0_THREAD
     g_usbd_core[busid].usbd_ep0_mq = usb_osal_mq_create(1);
     if (g_usbd_core[busid].usbd_ep0_mq == NULL) {
-        USB_LOG_ERR("No memory to alloc for g_usbd_core[busid].usbd_ep0_mq\r\n");
-        while (1) {
-        }
+        return -USB_ERR_NOMEM;
     }
     g_usbd_core[busid].usbd_ep0_thread = usb_osal_thread_create("usbd_ep0", CONFIG_USBDEV_EP0_STACKSIZE, CONFIG_USBDEV_EP0_PRIO, usbdev_ep0_thread, (void *)(uint32_t)busid);
     if (g_usbd_core[busid].usbd_ep0_thread == NULL) {
-        USB_LOG_ERR("No memory to alloc for g_usbd_core[busid].usbd_ep0_thread\r\n");
-        while (1) {
+        usb_osal_mq_delete(g_usbd_core[busid].usbd_ep0_mq);
+        return -USB_ERR_NOMEM;
         }
     }
 #endif
diff --git a/core/usbh_core.c b/core/usbh_core.c
index b7f762ea..5349feb6 100644
--- a/core/usbh_core.c
+++ b/core/usbh_core.c
@@ -242,7 +242,7 @@ static int parse_config_descriptor(struct usbh_hubport *hport, struct usb_config
                         return -USB_ERR_NOMEM;
                     }
 
-                    if (cur_ep_num >= CONFIG_USBHOST_MAX_ENDPOINTS) {
+                    if (cur_ep_num > CONFIG_USBHOST_MAX_ENDPOINTS) {
                         USB_LOG_ERR("Endpoint num %d overflow\r\n", cur_ep_num);
                         return -USB_ERR_NOMEM;
                     }
@@ -272,6 +272,12 @@ static int parse_config_descriptor(struct usbh_hubport *hport, struct usb_config
                         return -USB_ERR_INVAL;
                     }
                     ep_desc = (struct usb_endpoint_descriptor *)p;
+
+                    if (cur_ep >= CONFIG_USBHOST_MAX_ENDPOINTS) {
+                        USB_LOG_ERR("Endpoint num %d overflow\r\n", cur_ep);
+                        return -USB_ERR_NOMEM;
+                    }
+
                     memcpy(&hport->config.intf[cur_iface].altsetting[cur_alt_setting].ep[cur_ep].ep_desc, ep_desc, 7);
                     cur_ep++;
                     break;
@@ -360,7 +366,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wLength = 8;
 
     ret = usbh_control_transfer(hport, setup, ep0_request_buffer[hport->bus->busid]);
-    if (ret < 0) {
+    if (ret < 8) {
         USB_LOG_ERR("Failed to get device descriptor,errorcode:%d\r\n", ret);
         goto errout;
     }
@@ -420,7 +426,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wLength = USB_SIZEOF_DEVICE_DESC;
 
     ret = usbh_control_transfer(hport, setup, ep0_request_buffer[hport->bus->busid]);
-    if (ret < 0) {
+    if (ret < USB_SIZEOF_DEVICE_DESC) {
         USB_LOG_ERR("Failed to get full device descriptor,errorcode:%d\r\n", ret);
         goto errout;
     }
@@ -444,7 +450,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wLength = USB_SIZEOF_CONFIG_DESC;
 
     ret = usbh_control_transfer(hport, setup, ep0_request_buffer[hport->bus->busid]);
-    if (ret < 0) {
+    if (ret < USB_SIZEOF_CONFIG_DESC) {
         USB_LOG_ERR("Failed to get config descriptor,errorcode:%d\r\n", ret);
         goto errout;
     }
@@ -471,7 +477,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wLength = wTotalLength;
 
     ret = usbh_control_transfer(hport, setup, ep0_request_buffer[hport->bus->busid]);
-    if (ret < 0) {
+    if (ret < wTotalLength) {
         USB_LOG_ERR("Failed to get full config descriptor,errorcode:%d\r\n", ret);
         goto errout;
     }
@@ -715,7 +721,7 @@ resubmit:
         ret = urb->actual_length;
     }
 
-    if (ret < 0 && (ret != -USB_ERR_TIMEOUT)) {
+    if (ret < sizeof(struct usb_setup_packet) && (ret != -USB_ERR_TIMEOUT)) {
         retry--;
         if (retry > 0) {
             USB_LOG_WRN("Control transfer failed, errorcode %d, retrying...\r\n", ret);
@@ -724,7 +730,7 @@ resubmit:
     }
 
     usb_osal_mutex_give(hport->mutex);
-    return ret;
+    return ret < sizeof(struct usb_setup_packet) ? ret : (ret - sizeof(struct usb_setup_packet));
 }
 
 int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *output, uint16_t output_len)
@@ -753,6 +759,13 @@ int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *out
     dst = output;
     len = src[0];
 
+    if (ret != len) {
+        USB_LOG_ERR("Get string descriptor failed, expect %d, actual %d\r\n", len, ret);
+        return -USB_ERR_IO;
+    }
+
+    memset(output, 0, output_len);
+
     if (((len - 2) / 2) > output_len) {
         return -USB_ERR_NOMEM;
     }
diff --git a/core/usbotg_core.c b/core/usbotg_core.c
index 54237e69..cf83f53a 100644
--- a/core/usbotg_core.c
+++ b/core/usbotg_core.c
@@ -88,17 +88,14 @@ int usbotg_initialize(uint8_t busid, uint32_t reg_base, usbd_event_handler_t dev
 
     g_usbotg_core[busid].change_sem = usb_osal_sem_create(0);
     if (g_usbotg_core[busid].change_sem == NULL) {
-        USB_LOG_ERR("Failed to create change_sem\r\n");
-        while (1) {
-        }
+        return -USB_ERR_NOMEM;
     }
 
     snprintf(thread_name, 32, "usbotg%u", busid);
     g_usbotg_core[busid].change_thread = usb_osal_thread_create(thread_name, 2048, 10, usbotg_rolechange_thread, (void *)(uintptr_t)busid);
     if (g_usbotg_core[busid].change_thread == NULL) {
-        USB_LOG_ERR("Failed to create usbotg thread\r\n");
-        while (1) {
-        }
+        usb_osal_sem_delete(g_usbotg_core[busid].change_sem);
+        return -USB_ERR_NOMEM;
     }
 
     usbotg_trigger_role_change(busid, default_role);