From patchwork Tue Jan 3 16:28:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathias Nyman X-Patchwork-Id: 89684 Delivered-To: patch@linaro.org Received: by 10.140.20.101 with SMTP id 92csp8083322qgi; Tue, 3 Jan 2017 08:27:59 -0800 (PST) X-Received: by 10.84.216.8 with SMTP id m8mr137160340pli.116.1483460879489; Tue, 03 Jan 2017 08:27:59 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u90si69599403pfd.87.2017.01.03.08.27.59; Tue, 03 Jan 2017 08:27:59 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759530AbdACQ16 (ORCPT + 3 others); Tue, 3 Jan 2017 11:27:58 -0500 Received: from mga06.intel.com ([134.134.136.31]:57017 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759499AbdACQ14 (ORCPT ); Tue, 3 Jan 2017 11:27:56 -0500 Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by orsmga104.jf.intel.com with ESMTP; 03 Jan 2017 08:27:55 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.33,455,1477983600"; d="scan'208";a="209201174" Received: from mattu-haswell.fi.intel.com ([10.237.72.164]) by fmsmga004.fm.intel.com with ESMTP; 03 Jan 2017 08:27:53 -0800 From: Mathias Nyman To: Cc: , Baolin Wang , , Mathias Nyman Subject: [PATCH 05/11] usb: host: xhci: Fix possible wild pointer when handling abort command Date: Tue, 3 Jan 2017 18:28:47 +0200 Message-Id: <1483460933-15567-6-git-send-email-mathias.nyman@linux.intel.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1483460933-15567-1-git-send-email-mathias.nyman@linux.intel.com> References: <1483460933-15567-1-git-send-email-mathias.nyman@linux.intel.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Baolin Wang When current command was supposed to be aborted, host will free the command in handle_cmd_completion() function. But it might be still referenced by xhci->current_cmd, which need to set NULL. Cc: Signed-off-by: Baolin Wang Signed-off-by: Mathias Nyman --- drivers/usb/host/xhci-ring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index acc3731..bc8be6f 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1363,8 +1363,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, */ if (cmd_comp_code == COMP_CMD_ABORT) { xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; - if (cmd->status == COMP_CMD_ABORT) + if (cmd->status == COMP_CMD_ABORT) { + if (xhci->current_cmd == cmd) + xhci->current_cmd = NULL; goto event_handled; + } } cmd_type = TRB_FIELD_TO_TYPE(le32_to_cpu(cmd_trb->generic.field[3]));