[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240917100703.80166-1-r.smirnov@omp.ru>
Date: Tue, 17 Sep 2024 13:07:03 +0300
From: Roman Smirnov <r.smirnov@....ru>
To: <stable@...r.kernel.org>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC: Roman Smirnov <r.smirnov@....ru>, Mark Brown <broonie@...nel.org>, "Rafael
J. Wysocki" <rafael@...nel.org>, <linux-kernel@...r.kernel.org>, Sergey
Shtylyov <s.shtylyov@....ru>, Karina Yankevich <k.yankevich@....ru>, Sergey
Yudin <s.yudin@....ru>, <lvc-project@...uxtesting.org>, Mathias Nyman
<mathias.nyman@...ux.intel.com>
Subject: [PATCH 5.10] xhci: check virt_dev is valid before dereferencing it
From: Mathias Nyman <mathias.nyman@...ux.intel.com>
commit 03ed579d9d51aa018830b0de3e8b463faf6b87db upstream.
Check that the xhci_virt_dev structure that we dug out based
on a slot_id value from a command completion is valid before
dereferencing it.
Signed-off-by: Mathias Nyman <mathias.nyman@...ux.intel.com>
Link: https://lore.kernel.org/r/20210129130044.206855-7-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Signed-off-by: Roman Smirnov <r.smirnov@....ru>
---
drivers/usb/host/xhci-ring.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index fbb7a5b51ef4..a769803e7d38 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1415,6 +1415,8 @@ static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id,
* is not waiting on the configure endpoint command.
*/
virt_dev = xhci->devs[slot_id];
+ if (!virt_dev)
+ return;
ctrl_ctx = xhci_get_input_control_ctx(virt_dev->in_ctx);
if (!ctrl_ctx) {
xhci_warn(xhci, "Could not get input context, bad type.\n");
@@ -1459,6 +1461,8 @@ static void xhci_handle_cmd_addr_dev(struct xhci_hcd *xhci, int slot_id)
struct xhci_slot_ctx *slot_ctx;
vdev = xhci->devs[slot_id];
+ if (!vdev)
+ return;
slot_ctx = xhci_get_slot_ctx(xhci, vdev->out_ctx);
trace_xhci_handle_cmd_addr_dev(slot_ctx);
}
@@ -1470,13 +1474,15 @@ static void xhci_handle_cmd_reset_dev(struct xhci_hcd *xhci, int slot_id,
struct xhci_slot_ctx *slot_ctx;
vdev = xhci->devs[slot_id];
+ if (!vdev) {
+ xhci_warn(xhci, "Reset device command completion for disabled slot %u\n",
+ slot_id);
+ return;
+ }
slot_ctx = xhci_get_slot_ctx(xhci, vdev->out_ctx);
trace_xhci_handle_cmd_reset_dev(slot_ctx);
xhci_dbg(xhci, "Completed reset device command.\n");
- if (!xhci->devs[slot_id])
- xhci_warn(xhci, "Reset device command completion "
- "for disabled slot %u\n", slot_id);
}
static void xhci_handle_cmd_nec_get_fw(struct xhci_hcd *xhci,
--
2.34.1
Powered by blists - more mailing lists