aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAMAN DEEP <aman.deep@samsung.com>2015-07-21 10:20:27 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-07-22 17:19:36 -0400
commit3496810663922617d4b706ef2780c279252ddd6a (patch)
tree522e6d04833ecd647b4cdf03a61b2a3771d2564e
parentabce329c27b315cfc01be1a305ee976ee13ed4cf (diff)
usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
virt_dev->num_cached_rings counts on freed ring and is not updated correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring is added into cache and then num_rings_cache is incremented as below: virt_dev->ring_cache[rings_cached] = virt_dev->eps[ep_index].ring; virt_dev->num_rings_cached++; here, free ring pointer is added to a current index and then index is incremented. So current index always points to empty location in the ring cache. For getting available free ring, current index should be decremented first and then corresponding ring buffer value should be taken from ring cache. But In function xhci_endpoint_init(), the num_rings_cached index is accessed before decrement. virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; virt_dev->num_rings_cached--; This is bug in manipulating the index of ring cache. And it should be as below: virt_dev->num_rings_cached--; virt_dev->eps[ep_index].new_ring = virt_dev->ring_cache[virt_dev->num_rings_cached]; virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; Cc: <stable@vger.kernel.org> Signed-off-by: Aman Deep <aman.deep@samsung.com> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/host/xhci-mem.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index f8336408ef07..3e442f77a2b9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
1427 /* Attempt to use the ring cache */ 1427 /* Attempt to use the ring cache */
1428 if (virt_dev->num_rings_cached == 0) 1428 if (virt_dev->num_rings_cached == 0)
1429 return -ENOMEM; 1429 return -ENOMEM;
1430 virt_dev->num_rings_cached--;
1430 virt_dev->eps[ep_index].new_ring = 1431 virt_dev->eps[ep_index].new_ring =
1431 virt_dev->ring_cache[virt_dev->num_rings_cached]; 1432 virt_dev->ring_cache[virt_dev->num_rings_cached];
1432 virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL; 1433 virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
1433 virt_dev->num_rings_cached--;
1434 xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring, 1434 xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
1435 1, type); 1435 1, type);
1436 } 1436 }