Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e19d1c64 authored by Mathias Nyman's avatar Mathias Nyman Committed by Greg Kroah-Hartman
Browse files

xhci: Fix NULL pointer dereference when cleaning up streams for removed host 



commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.

This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.

The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.

Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.

Reported-by: default avatarrocko r <rockorequin@gmail.com>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ceef5c4c

drivers/usb/host/xhci-ring.c

+7 −4
Original line number Original line Diff line number Diff line
@@ -782,13 +782,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci, 
			(ep->ep_state & EP_GETTING_NO_STREAMS)) {

			(ep->ep_state & EP_GETTING_NO_STREAMS)) {

		int stream_id;

		int stream_id;





		for (stream_id = 0; stream_id < ep->stream_info->num_streams;

		for (stream_id = 1; stream_id < ep->stream_info->num_streams;

				stream_id++) {

				stream_id++) {

			ring = ep->stream_info->stream_rings[stream_id];

			if (!ring)

				continue;



			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,

			xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,

					"Killing URBs for slot ID %u, ep index %u, stream %u",

					"Killing URBs for slot ID %u, ep index %u, stream %u",

					slot_id, ep_index, stream_id + 1);

					slot_id, ep_index, stream_id);

			xhci_kill_ring_urbs(xhci,

			xhci_kill_ring_urbs(xhci, ring);

					ep->stream_info->stream_rings[stream_id]);

		}

		}

	} else {

	} else {

		ring = ep->ring;

		ring = ep->ring;