Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bcf42aa6 authored by Mathias Nyman's avatar Mathias Nyman Committed by Greg Kroah-Hartman
Browse files

xhci: fix null pointer dereference in stop command timeout function 



The stop endpoint command has its own 5 second timeout timer.
If the timeout function is triggered between USB3 and USB2 host
removal it will try to call usb_hc_died(xhci_to_hcd(xhci)->primary_hcd)

the ->primary_hcd will be set to NULL at USB3 hcd removal.

Fix this by first checking if the PCI host is being removed, and
also by using only xhci_to_hcd() as it will always return the primary
hcd.

CC: <stable@vger.kernel.org>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c6935931

drivers/usb/host/xhci-ring.c

+5 −1
Original line number Diff line number Diff line
@@ -850,6 +850,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg) 
	spin_lock_irqsave(&xhci->lock, flags);



	ep->stop_cmds_pending--;

	if (xhci->xhc_state & XHCI_STATE_REMOVING) {

		spin_unlock_irqrestore(&xhci->lock, flags);

		return;

	}

	if (xhci->xhc_state & XHCI_STATE_DYING) {

		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,

				"Stop EP timer ran, but another timer marked "
@@ -903,7 +907,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg) 
	spin_unlock_irqrestore(&xhci->lock, flags);

	xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,

			"Calling usb_hc_died()");

	usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);

	usb_hc_died(xhci_to_hcd(xhci));

	xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,

			"xHCI host controller is dead.");

}