xhci: Fix NULL pointer dereference when cleaning up streams for removed host
authorMathias Nyman <mathias.nyman@linux.intel.com>
Thu, 20 Jul 2017 11:48:26 +0000 (14:48 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 20 Jul 2017 12:40:35 +0000 (14:40 +0200)
commit4b895868bb2da60a386a17cde3bf9ecbc70c79f4
treeb2cda155a97ff5e0e0cbc20889775cb03249e3f8
parent3d69f3a8c2ed1c7f322d23145bc0c3d980ebbacb
xhci: Fix NULL pointer dereference when cleaning up streams for removed host

This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.

The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.

Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.

Reported-by: rocko r <rockorequin@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci-ring.c