Commit 01845a83 authored by Mathias Nyman's avatar Mathias Nyman Committed by Greg Kroah-Hartman

xhci: Fix NULL pointer dereference when cleaning up streams for removed host

commit 4b895868 upstream.

This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.

The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.

Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.
Reported-by: default avatarrocko r <rockorequin@gmail.com>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bf044088
...@@ -860,13 +860,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci, ...@@ -860,13 +860,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
(ep->ep_state & EP_GETTING_NO_STREAMS)) { (ep->ep_state & EP_GETTING_NO_STREAMS)) {
int stream_id; int stream_id;
for (stream_id = 0; stream_id < ep->stream_info->num_streams; for (stream_id = 1; stream_id < ep->stream_info->num_streams;
stream_id++) { stream_id++) {
ring = ep->stream_info->stream_rings[stream_id];
if (!ring)
continue;
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"Killing URBs for slot ID %u, ep index %u, stream %u", "Killing URBs for slot ID %u, ep index %u, stream %u",
slot_id, ep_index, stream_id + 1); slot_id, ep_index, stream_id);
xhci_kill_ring_urbs(xhci, xhci_kill_ring_urbs(xhci, ring);
ep->stream_info->stream_rings[stream_id]);
} }
} else { } else {
ring = ep->ring; ring = ep->ring;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment