usb: xhci: Handle error condition in xhci_stop_device() (b3207c65) · Commits · 戴 / test

xhci_stop_device() calls xhci_queue_stop_endpoint() multiple times without checking the return value. xhci_queue_stop_endpoint() can return error if the HC is already halted or unable to queue commands. This can cause a deadlock condition as xhci_stop_device() would end up waiting indefinitely for a completion for the command that didn't get queued. Fix this by checking the return value and bailing out of xhci_stop_device() in case of error. This patch happens to fix potential memory leaks of the allocated command structures as well. Fixes: ("xhci: rework command timeout and cancellation,") Cc: <stable@vger.kernel.org> Signed-off-by:

Mayank Rana <mrana@codeaurora.org> Signed-off-by:

Jack Pham <jackp@codeaurora.org> Signed-off-by:

Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/usb/host/xhci-hub.c

+18 −5

Original line number	Diff line number	Diff line
		@@ -420,14 +420,25 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
		GFP_NOWAIT);
		if (!command) {
		spin_unlock_irqrestore(&xhci->lock, flags);
		xhci_free_command(xhci, cmd);
		return -ENOMEM;
		ret = -ENOMEM;
		goto cmd_cleanup;
		}

		ret = xhci_queue_stop_endpoint(xhci, command, slot_id,
		i, suspend);
		if (ret) {
		spin_unlock_irqrestore(&xhci->lock, flags);
		xhci_free_command(xhci, command);
		goto cmd_cleanup;
		}
		xhci_queue_stop_endpoint(xhci, command, slot_id, i,
		suspend);
		}
		}
		xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
		ret = xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend);
		if (ret) {
		spin_unlock_irqrestore(&xhci->lock, flags);
		goto cmd_cleanup;
		}

		xhci_ring_cmd_db(xhci);
		spin_unlock_irqrestore(&xhci->lock, flags);

		@@ -439,6 +450,8 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
		xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
		ret = -ETIME;
		}

		cmd_cleanup:
		xhci_free_command(xhci, cmd);
		return ret;
		}

Admin message