Commit 43a09f7f authored Oct 16, 2012 by Sarah Sharp

xhci: Fix potential NULL ptr deref in command cancellation.



The command cancellation code doesn't check whether find_trb_seg()
couldn't find the segment that contains the TRB to be canceled.  This
could cause a NULL pointer deference later in the function when next_trb
is called.  It's unlikely to happen unless something is wrong with the
command ring pointers, so add some debugging in case it happens.

This patch should be backported to stable kernels as old as 3.0, that
contain the commit b63f4053 "xHCI:
handle command after aborting the command ring".

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

parent 8daf8b60

drivers/usb/host/xhci-ring.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -1228,6 +1228,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd xhci, struct xhci_cd cur_cd)
		cur_seg = find_trb_seg(xhci->cmd_ring->first_seg,
		xhci->cmd_ring->dequeue, &cycle_state);

		if (!cur_seg) {
		xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n",
		xhci->cmd_ring->dequeue,
		(unsigned long long)
		xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
		xhci->cmd_ring->dequeue));
		xhci_debug_ring(xhci, xhci->cmd_ring);
		xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
		return;
		}

		/* find the command trb matched by cd from command ring */
		for (cmd_trb = xhci->cmd_ring->dequeue;
		cmd_trb != xhci->cmd_ring->enqueue;

Admin message