lkml.org 
[lkml]   [2013]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[79/84] xhci: fix null pointer dereference on ring_doorbell_for_active_rings
    3.2.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Oleksij Rempel <linux@rempel-privat.de>

    commit d66eaf9f89502971fddcb0de550b01fa6f409d83 upstream.

    in some cases where device is attched to xhci port and do not responding,
    for example ath9k_htc with stalled firmware, kernel will
    crash on ring_doorbell_for_active_rings.
    This patch check if pointer exist before it is used.

    This patch should be backported to kernels as old as 2.6.35, that
    contain the commit e9df17eb1408cfafa3d1844bfc7f22c7237b31b8 "USB: xhci:
    Correct assumptions about number of rings per endpoint"

    Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/host/xhci-ring.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -463,7 +463,7 @@ static void ring_doorbell_for_active_rin

    /* A ring has pending URBs if its TD list is not empty */
    if (!(ep->ep_state & EP_HAS_STREAMS)) {
    - if (!(list_empty(&ep->ring->td_list)))
    + if (ep->ring && !(list_empty(&ep->ring->td_list)))
    xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
    return;
    }


    \
     
     \ /
      Last update: 2013-07-31 16:21    [W:5.207 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site