xhci: Fix use after free for URB cancellation on a reallocated endpoint
authorMathias Nyman <mathias.nyman@linux.intel.com>
Fri, 31 Aug 2018 14:24:43 +0000 (17:24 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Sep 2018 11:27:06 +0000 (13:27 +0200)
commit4937213ba7fafa13f30496b3965ffe93970d8b53
tree9bc4429b90cb9b451d2c2e400a599c7e06509b56
parent9b83a1c301ad6d24988a128c69b42cbaaf537d82
xhci: Fix use after free for URB cancellation on a reallocated endpoint

Make sure the cancelled URB is on the current endpoint ring.

If the endpoint ring has been reallocated since the URB was enqueued
then the URB may contain TD and TRB pointers to a already freed ring.
In this the case return the URB without touching any of the freed ring
structure data.

Don't try to stop the ring. It would be useless.

This can occur if endpoint is not flushed before it is dropped and
re-added, which is the case in usb_set_interface() as xhci does
things in an odd order.

Cc: <stable@vger.kernel.org>
Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci.c