Merge "USB: fix invalid memory access in hub_activate()" (4c4eac84) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/usb/core/hub.c

+19 −3

Original line number	Original line	Diff line number	Diff line
	@@ -1030,10 +1030,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
	unsigned delay;		unsigned delay;

	/* Continue a partial initialization */		/* Continue a partial initialization */
			if (type == HUB_INIT2 \|\| type == HUB_INIT3) {
			device_lock(hub->intfdev);

			/* Was the hub disconnected while we were waiting? */
			if (hub->disconnected) {
			device_unlock(hub->intfdev);
			kref_put(&hub->kref, hub_release);
			return;
			}
	if (type == HUB_INIT2)		if (type == HUB_INIT2)
	goto init2;		goto init2;
	if (type == HUB_INIT3)
	goto init3;		goto init3;
			}
			kref_get(&hub->kref);

	/* The superspeed hub except for root hub has to use Hub Depth		/* The superspeed hub except for root hub has to use Hub Depth
	* value as an offset into the route string to locate the bits		* value as an offset into the route string to locate the bits
	@@ -1231,6 +1241,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
	queue_delayed_work(system_power_efficient_wq,		queue_delayed_work(system_power_efficient_wq,
	&hub->init_work,		&hub->init_work,
	msecs_to_jiffies(delay));		msecs_to_jiffies(delay));
			device_unlock(hub->intfdev);
	return; /* Continues at init3: below */		return; /* Continues at init3: below */
	} else {		} else {
	msleep(delay);		msleep(delay);
	@@ -1252,6 +1263,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
	/* Allow autosuspend if it was suppressed */		/* Allow autosuspend if it was suppressed */
	if (type <= HUB_INIT3)		if (type <= HUB_INIT3)
	usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));		usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));

			if (type == HUB_INIT2 \|\| type == HUB_INIT3)
			device_unlock(hub->intfdev);

			kref_put(&hub->kref, hub_release);
	}		}

	/* Implement the continuations for the delays above */		/* Implement the continuations for the delays above */