| From: Baolin Wang <baolin.wang@linaro.org> |
| Date: Tue, 3 Jan 2017 18:28:47 +0200 |
| Subject: usb: host: xhci: Fix possible wild pointer when handling abort |
| command |
| |
| commit 2a7cfdf37b7c08ac29df4c62ea5ccb01474b6597 upstream. |
| |
| When current command was supposed to be aborted, host will free the command |
| in handle_cmd_completion() function. But it might be still referenced by |
| xhci->current_cmd, which need to set NULL. |
| |
| Signed-off-by: Baolin Wang <baolin.wang@linaro.org> |
| Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/host/xhci-ring.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/usb/host/xhci-ring.c |
| +++ b/drivers/usb/host/xhci-ring.c |
| @@ -1380,8 +1380,11 @@ static void handle_cmd_completion(struct |
| */ |
| if (cmd_comp_code == COMP_CMD_ABORT) { |
| xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; |
| - if (cmd->status == COMP_CMD_ABORT) |
| + if (cmd->status == COMP_CMD_ABORT) { |
| + if (xhci->current_cmd == cmd) |
| + xhci->current_cmd = NULL; |
| goto event_handled; |
| + } |
| } |
| |
| cmd_type = TRB_FIELD_TO_TYPE(le32_to_cpu(cmd_trb->generic.field[3])); |
