Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9191eee7 authored by Sarah Sharp's avatar Sarah Sharp Committed by Greg Kroah-Hartman
Browse files

USB: xhci: Don't touch xhci_td after it's freed. 



On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver.  Don't touch urb->td after it's freed.  This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.

Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 83fbcdcc

drivers/usb/host/xhci-ring.c

+1 −1
Original line number Diff line number Diff line
@@ -1193,7 +1193,7 @@ static int handle_tx_event(struct xhci_hcd *xhci, 
	if (urb) {

		usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);

		xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",

				urb, td->urb->actual_length, status);

				urb, urb->actual_length, status);

		spin_unlock(&xhci->lock);

		usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);

		spin_lock(&xhci->lock);