Commit 66cb618b authored by Niklas Neronin's avatar Niklas Neronin Committed by Greg Kroah-Hartman
Browse files

usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB 



Some transfer events don't always point to a TRB, and consequently don't
have a endpoint ring. In these cases, function handle_tx_event() should
not proceed, because if 'ep->skip' is set, the pointer to the endpoint
ring is used.

To prevent a potential failure and make the code logical, return after
checking the completion code for a Transfer event without TRBs.

Signed-off-by: default avatarNiklas Neronin <niklas.neronin@linux.intel.com>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 34b67198

drivers/usb/host/xhci-ring.c

+3 −2
Original line number Diff line number Diff line
@@ -2625,16 +2625,17 @@ static int handle_tx_event(struct xhci_hcd *xhci, 
			else

				xhci_handle_halted_endpoint(xhci, ep, NULL,

							    EP_SOFT_RESET);

			goto cleanup;

			break;

		case COMP_RING_UNDERRUN:

		case COMP_RING_OVERRUN:

		case COMP_STOPPED_LENGTH_INVALID:

			goto cleanup;

			break;

		default:

			xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",

				 slot_id, ep_index);

			goto err_out;

		}

		return 0;

	}



	/* Count current td numbers if ep->skip is set */