xhci: Fix list corruption in urb dequeue at host removal
xhci driver frees data for all devices, both usb2 and and usb3 the first time usb_remove_hcd() is called, including td_list and and xhci_ring structures. When usb_remove_hcd() is called a second time for the second xhci bus it will try to dequeue all pending urbs, and touches td_list which is already freed for that endpoint. Cc: <stable@vger.kernel.org> Reported-by: Joe Lawrence <joe.lawrence@stratus.com> Tested-by: Joe Lawrence <joe.lawrence@stratus.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2ad294d5f9
commit
5c82171167
1 changed files with 3 additions and 1 deletions
|
@ -1554,7 +1554,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
|
||||||
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
|
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
|
||||||
"HW died, freeing TD.");
|
"HW died, freeing TD.");
|
||||||
urb_priv = urb->hcpriv;
|
urb_priv = urb->hcpriv;
|
||||||
for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
|
for (i = urb_priv->td_cnt;
|
||||||
|
i < urb_priv->length && xhci->devs[urb->dev->slot_id];
|
||||||
|
i++) {
|
||||||
td = urb_priv->td[i];
|
td = urb_priv->td[i];
|
||||||
if (!list_empty(&td->td_list))
|
if (!list_empty(&td->td_list))
|
||||||
list_del_init(&td->td_list);
|
list_del_init(&td->td_list);
|
||||||
|
|
Loading…
Reference in a new issue