xhci: Fix NULL pointer dereference when cleaning up streams for removed host
authorMathias Nyman <mathias.nyman@linux.intel.com>
Thu, 20 Jul 2017 11:48:26 +0000 (14:48 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jul 2017 22:08:00 +0000 (15:08 -0700)
commit01845a8347b73ddc89c0e7a81a108a4786ff07ea
tree14c82cf43015655d8758c78599a6001145b4ac4a
parentbf0440882ea94629b198b132ce89c11e25b4b91d
xhci: Fix NULL pointer dereference when cleaning up streams for removed host

commit 4b895868bb2da60a386a17cde3bf9ecbc70c79f4 upstream.

This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.

The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.

Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.

Reported-by: rocko r <rockorequin@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci-ring.c