diff options
| author | Mathias Nyman <mathias.nyman@linux.intel.com> | 2017-07-20 14:48:26 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-07-27 15:10:10 -0700 |
| commit | 7b7a1f02338d47489dbcbb517aa152f15a50e390 (patch) | |
| tree | 6f2c6c8b902dc9bdd65efc8773a3a15e15640a73 /drivers/usb/host/pci-quirks.h | |
| parent | be67d4afbee8c71628c4220d792c09b46bd4700e (diff) | |
| download | talos-op-linux-7b7a1f02338d47489dbcbb517aa152f15a50e390.tar.gz talos-op-linux-7b7a1f02338d47489dbcbb517aa152f15a50e390.zip | |
xhci: Fix NULL pointer dereference when cleaning up streams for removed host
commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.
This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.
The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.
Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.
Reported-by: rocko r <rockorequin@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/host/pci-quirks.h')
0 files changed, 0 insertions, 0 deletions
