| From d66eaf9f89502971fddcb0de550b01fa6f409d83 Mon Sep 17 00:00:00 2001 |
| From: Oleksij Rempel <linux@rempel-privat.de> |
| Date: Sun, 21 Jul 2013 15:36:19 +0200 |
| Subject: xhci: fix null pointer dereference on ring_doorbell_for_active_rings |
| |
| From: Oleksij Rempel <linux@rempel-privat.de> |
| |
| commit d66eaf9f89502971fddcb0de550b01fa6f409d83 upstream. |
| |
| in some cases where device is attched to xhci port and do not responding, |
| for example ath9k_htc with stalled firmware, kernel will |
| crash on ring_doorbell_for_active_rings. |
| This patch check if pointer exist before it is used. |
| |
| This patch should be backported to kernels as old as 2.6.35, that |
| contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci: |
| Correct assumptions about number of rings per endpoint" |
| |
| Signed-off-by: Oleksij Rempel <linux@rempel-privat.de> |
| Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/host/xhci-ring.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/usb/host/xhci-ring.c |
| +++ b/drivers/usb/host/xhci-ring.c |
| @@ -434,7 +434,7 @@ static void ring_doorbell_for_active_rin |
| |
| /* A ring has pending URBs if its TD list is not empty */ |
| if (!(ep->ep_state & EP_HAS_STREAMS)) { |
| - if (!(list_empty(&ep->ring->td_list))) |
| + if (ep->ring && !(list_empty(&ep->ring->td_list))) |
| xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0); |
| return; |
| } |