diff --git a/model/usb/device/f_generic.c b/model/usb/device/f_generic.c
index 1f7ce86ee8db94584707d16057e1c7f01047352e..d5f3a7c685afacb43318b4623e5af8a343167cad 100644
--- a/model/usb/device/f_generic.c
+++ b/model/usb/device/f_generic.c
@@ -1500,6 +1500,7 @@ static long usbfn_ioctl(struct file *file, unsigned int cmd, unsigned long value
 
             ret = memcpy_s(ffs->dev_name, MAX_NAMELEN, newfn.name, newfn.nameLen);
             if (ret != EOK) {
+                ffs_data_put(ffs);
                 HDF_LOGE("%{public}s:%{public}d memcpy_s failed", __func__, __LINE__);
                 return ret;
             }
@@ -1510,6 +1511,7 @@ static long usbfn_ioctl(struct file *file, unsigned int cmd, unsigned long value
             }
 
             if (sprintf_s(nameEp0, MAX_NAMELEN, "%s.ep%u", ffs->dev_name, 0) < 0) {
+                ffs_data_put(ffs);
                 return -EFAULT;
             }
             ffs_dev = ffs_acquire_dev(newfn.name);
@@ -1520,21 +1522,22 @@ static long usbfn_ioctl(struct file *file, unsigned int cmd, unsigned long value
             ffs->private_data = ffs_dev;
 
             ret = alloc_chrdev_region(&g_dev, 0, MAX_EP_DEV, nameEp0);
-            if (ret < 0)
-            {
+            if (ret < 0) {
+                ffs_release_dev(ffs);
+                ffs_data_put(ffs);
                 return -EBUSY;
             }
             cdev_init(&ffs->cdev, &ffs_ep0_operations);
             ffs->devno = MKDEV(MAJOR(g_dev), 0);
             ret = cdev_add(&ffs->cdev, ffs->devno, 1);
-            if (ret)
-            {
+            if (ret) {
+                ffs_release_dev(ffs);
+                ffs_data_put(ffs);
                 return -EBUSY;
             }
 
             ffs->fn_device = device_create(ffs_class, NULL, ffs->devno, NULL, nameEp0);
-            if (IS_ERR(ffs->fn_device))
-            {
+            if (IS_ERR(ffs->fn_device)) {
                 cdev_del(&ffs->cdev);
                 ffs_release_dev(ffs);
                 ffs_data_put(ffs);
diff --git a/model/usb/host/src/usb_pnp_notify.c b/model/usb/host/src/usb_pnp_notify.c
index 7e08b37df5e1b0ad20f19fefbf9bcb1a433d1f8f..b7d2fabd5a1411d8d667bf5ac0d3321f67e3561d 100644
--- a/model/usb/host/src/usb_pnp_notify.c
+++ b/model/usb/host/src/usb_pnp_notify.c
@@ -532,6 +532,11 @@ static int32_t GadgetPnpNotifyHdfSendEvent(const struct HdfDeviceObject *deviceO
 static int32_t UsbPnpNotifyFirstReport(struct usb_device *usbDev, void *data)
 {
     int32_t ret;
+    if (data == NULL) {
+        HDF_LOGE("%{pubilc}s:%{pubilc}d data is NULL", __func__, __LINE__);
+        return HDF_FAILURE;
+    }
+    
     struct HdfDeviceIoClient *client = (struct HdfDeviceIoClient *)data;
 
     ret = UsbPnpNotifyHdfSendEvent(client->device, usbDev);