diff options
| author | Mathias Nyman <mathias.nyman@linux.intel.com> | 2016-09-07 17:26:33 +0300 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-10-05 22:40:20 -0400 |
| commit | 10494714165113e2a1c9a8013109319d054dc426 (patch) | |
| tree | ea5eb4e6164c0fb520283c3d6856998a6c51f122 | |
| parent | 029a0cab4ef671ac1a5c4bfe7e4c39a2ddaff10d (diff) | |
| download | lwn-10494714165113e2a1c9a8013109319d054dc426.tar.gz lwn-10494714165113e2a1c9a8013109319d054dc426.zip | |
xhci: fix null pointer dereference in stop command timeout function
[ Upstream commit bcf42aa60c2832510b9be0f30c090bfd35bb172d ]
The stop endpoint command has its own 5 second timeout timer.
If the timeout function is triggered between USB3 and USB2 host
removal it will try to call usb_hc_died(xhci_to_hcd(xhci)->primary_hcd)
the ->primary_hcd will be set to NULL at USB3 hcd removal.
Fix this by first checking if the PCI host is being removed, and
also by using only xhci_to_hcd() as it will always return the primary
hcd.
CC: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | drivers/usb/host/xhci-ring.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 51ff57497b91..c15dbffe660b 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -839,6 +839,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg) spin_lock_irqsave(&xhci->lock, flags); ep->stop_cmds_pending--; + if (xhci->xhc_state & XHCI_STATE_REMOVING) { + spin_unlock_irqrestore(&xhci->lock, flags); + return; + } if (xhci->xhc_state & XHCI_STATE_DYING) { xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, "Stop EP timer ran, but another timer marked " @@ -892,7 +896,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg) spin_unlock_irqrestore(&xhci->lock, flags); xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, "Calling usb_hc_died()"); - usb_hc_died(xhci_to_hcd(xhci)->primary_hcd); + usb_hc_died(xhci_to_hcd(xhci)); xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, "xHCI host controller is dead."); } |