| From bcf42aa60c2832510b9be0f30c090bfd35bb172d Mon Sep 17 00:00:00 2001 |
| From: Mathias Nyman <mathias.nyman@linux.intel.com> |
| Date: Wed, 7 Sep 2016 17:26:33 +0300 |
| Subject: xhci: fix null pointer dereference in stop command timeout function |
| |
| From: Mathias Nyman <mathias.nyman@linux.intel.com> |
| |
| commit bcf42aa60c2832510b9be0f30c090bfd35bb172d upstream. |
| |
| The stop endpoint command has its own 5 second timeout timer. |
| If the timeout function is triggered between USB3 and USB2 host |
| removal it will try to call usb_hc_died(xhci_to_hcd(xhci)->primary_hcd) |
| |
| the ->primary_hcd will be set to NULL at USB3 hcd removal. |
| |
| Fix this by first checking if the PCI host is being removed, and |
| also by using only xhci_to_hcd() as it will always return the primary |
| hcd. |
| |
| Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/host/xhci-ring.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/usb/host/xhci-ring.c |
| +++ b/drivers/usb/host/xhci-ring.c |
| @@ -840,6 +840,10 @@ void xhci_stop_endpoint_command_watchdog |
| spin_lock_irqsave(&xhci->lock, flags); |
| |
| ep->stop_cmds_pending--; |
| + if (xhci->xhc_state & XHCI_STATE_REMOVING) { |
| + spin_unlock_irqrestore(&xhci->lock, flags); |
| + return; |
| + } |
| if (xhci->xhc_state & XHCI_STATE_DYING) { |
| xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, |
| "Stop EP timer ran, but another timer marked " |
| @@ -893,7 +897,7 @@ void xhci_stop_endpoint_command_watchdog |
| spin_unlock_irqrestore(&xhci->lock, flags); |
| xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, |
| "Calling usb_hc_died()"); |
| - usb_hc_died(xhci_to_hcd(xhci)->primary_hcd); |
| + usb_hc_died(xhci_to_hcd(xhci)); |
| xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, |
| "xHCI host controller is dead."); |
| } |
