Skip to content

Commit 802dcaf

Browse files
matnymangregkh
authored andcommitted
xhci: Fix null pointer dereference in resume if xhci has only one roothub
In the re-init path xhci_resume() passes 'hcd->primary_hcd' to hci_init(), however this field isn't initialized by __usb_create_hcd() for a HCD without secondary controller. xhci_resume() is called once per xHC device, not per hcd, so the extra checking for primary hcd can be removed. Fixes: e0fe986 ("usb: host: xhci-plat: prepare operation w/o shared hcd") Reported-by: Matthias Kaehlcke <mka@chromium.org> Tested-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20220610115338.863152-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 8bd6b8c commit 802dcaf

1 file changed

Lines changed: 5 additions & 10 deletions

File tree

drivers/usb/host/xhci.c

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1107,7 +1107,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
11071107
{
11081108
u32 command, temp = 0;
11091109
struct usb_hcd *hcd = xhci_to_hcd(xhci);
1110-
struct usb_hcd *secondary_hcd;
11111110
int retval = 0;
11121111
bool comp_timer_running = false;
11131112
bool pending_portevent = false;
@@ -1214,23 +1213,19 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
12141213
* first with the primary HCD, and then with the secondary HCD.
12151214
* If we don't do the same, the host will never be started.
12161215
*/
1217-
if (!usb_hcd_is_primary_hcd(hcd))
1218-
secondary_hcd = hcd;
1219-
else
1220-
secondary_hcd = xhci->shared_hcd;
1221-
12221216
xhci_dbg(xhci, "Initialize the xhci_hcd\n");
1223-
retval = xhci_init(hcd->primary_hcd);
1217+
retval = xhci_init(hcd);
12241218
if (retval)
12251219
return retval;
12261220
comp_timer_running = true;
12271221

12281222
xhci_dbg(xhci, "Start the primary HCD\n");
1229-
retval = xhci_run(hcd->primary_hcd);
1230-
if (!retval && secondary_hcd) {
1223+
retval = xhci_run(hcd);
1224+
if (!retval && xhci->shared_hcd) {
12311225
xhci_dbg(xhci, "Start the secondary HCD\n");
1232-
retval = xhci_run(secondary_hcd);
1226+
retval = xhci_run(xhci->shared_hcd);
12331227
}
1228+
12341229
hcd->state = HC_STATE_SUSPENDED;
12351230
if (xhci->shared_hcd)
12361231
xhci->shared_hcd->state = HC_STATE_SUSPENDED;

0 commit comments

Comments
 (0)