Commit ae4ff9de authored by Mathias Nyman's avatar Mathias Nyman Committed by Greg Kroah-Hartman
Browse files

xhci: Fix NULL pointer dereference when reading portli debugfs files 



Michal reported and debgged a NULL pointer dereference bug in the
recently added portli debugfs files

Oops is caused when there are more port registers counted in
xhci->max_ports than ports reported by Supported Protocol capabilities.
This is possible if max_ports is more than maximum port number, or
if there are gaps between ports of different speeds the 'Supported
Protocol' capabilities.

In such cases port->rhub will be NULL so we can't reach xhci behind it.
Add an explicit NULL check for this case, and print portli in hex
without dereferencing port->rhub.

Reported-by: default avatarMichal Pecio <michal.pecio@gmail.com>
Closes: https://lore.kernel.org/linux-usb/20260304103856.48b785fd.michal.pecio@gmail.com


Fixes: 384c57ec ("usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register.")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260304223639.3882398-4-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d6d5febd

drivers/usb/host/xhci-debugfs.c

+9 −1
Original line number Diff line number Diff line
@@ -386,11 +386,19 @@ static const struct file_operations port_fops = { 
static int xhci_portli_show(struct seq_file *s, void *unused)

{

	struct xhci_port	*port = s->private;

	struct xhci_hcd		*xhci = hcd_to_xhci(port->rhub->hcd);

	struct xhci_hcd		*xhci;

	u32			portli;



	portli = readl(&port->port_reg->portli);



	/* port without protocol capability isn't added to a roothub */

	if (!port->rhub) {

		seq_printf(s, "0x%08x\n", portli);

		return 0;

	}



	xhci = hcd_to_xhci(port->rhub->hcd);



	/* PORTLI fields are valid if port is a USB3 or eUSB2V2 port */

	if (port->rhub == &xhci->usb3_rhub)

		seq_printf(s, "0x%08x LEC=%u RLC=%u TLC=%u\n", portli,