From: a17671 <a17671@motorola.com>
Date: Thu, 6 Dec 2018 06:07:39 +0000 (+0800)
Subject: usb:xhci-hub:Fix Null pointer panic
X-Git-Tag: MMI-QSAS30.62-33-3~330
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=40d21f893222269971cc3172a574f83332fb055f;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git

usb:xhci-hub:Fix Null pointer panic

System panic at xhci_hub_check_speed+0x44/0x74
After disconnect the otg device from host
Add the null pointer check to fix the problem

panic trace:

[  394.979815,2] xhci-hcd xhci-hcd.2.auto: USB bus 2 deregistered
[  394.980005,2] xhci-hcd xhci-hcd.2.auto: remove, state 4
[  394.980100,2] usb usb1: USB disconnect, device number 1
[  394.954183,0] Unable to handle kernel read from unreadable memory
at virtual address 0000001c
[  395.067339,0] task: ffffffc876ef4400 task.stack: ffffff800b328000
[  395.073424,0] PC is at xhci_hub_check_speed+0x44/0x74
[  395.078455,0] LR is at xhci_hub_check_speed+0x14/0x74
[  395.094516,0] x29: ffffff800b32ba70 x28: 0000000000000000
[  395.099986,0] x27: ffffff800b32bc08 x26: 00000000ffffffff
[  395.105453,0] x25: 0000000000000001 x24: 0000000000000001
[  395.110924,0] x23: ffffffc84a14a140 x22: ffffffc835343800
[  395.116393,0] x21: 0000000000000000 x20: ffffffc84a14a000
[  395.121866,0] x19: ffffffc053b5c000 x18: 0000000000000001
[  395.127336,0] x17: 0000000000000000 x16: 0000000000000000
[  395.132844,0] x15: ffffff8009567000 x14: 0000000000000001
[  395.138275,0] x13: 0000000000258024 x12: 000000000000cf90
[  395.143745,0] x11: f6e18e3f25207900 x10: 0000000000000000
[  395.149216,0] x9 : ffffffc84a14a458 x8 : 0000000000000001
[  395.154688,0] x7 : 0000000000000000 x6 : ffffff80099394e6
[  395.160160,0] x5 : 0000000000000033 x4 : 0000000000000000
[  395.165627,0] x3 : ffffff800b32b968 x2 : ffffff8008090470
[  395.171097,0] x1 : ffffff800b32b968 x0 : 0000000000000000

[  396.318730,0] [<ffffff8008664eec>] xhci_hub_check_speed+0x44/0x74
[  396.324803,0] [<ffffff800862a20c>] hcd_bus_suspend+0x144/0x24c
[  396.330617,0] [<ffffff800863b768>] generic_suspend+0x44/0x4c
[  396.336262,0] [<ffffff800863001c>] usb_suspend_both+0x164/0x234
[  396.342165,0] [<ffffff800863058c>] usb_runtime_suspend+0x30/0x68
[  396.348159,0] [<ffffff80084ff07c>] __rpm_callback+0xc4/0x1cc
[  396.353800,0] [<ffffff80084fef34>] rpm_callback+0x28/0x7c
[  396.359181,0] [<ffffff80084fd268>] rpm_suspend+0x210/0x4dc
[  396.364652,0] [<ffffff80084fda74>] __pm_runtime_suspend+0x80/0xa4
[  396.370731,0] [<ffffff8008630730>] usb_runtime_idle+0x28/0x38
[  396.376461,0] [<ffffff80084ff07c>] __rpm_callback+0xc4/0x1cc
[  396.382105,0] [<ffffff80084fd8a4>] rpm_idle+0x200/0x350
[  396.387314,0] [<ffffff80084fe9f0>] pm_runtime_work+0x5c/0x90
[  396.392961,0] [<ffffff80080c8d28>] process_one_work+0x1dc/0x408
[  396.398863,0] [<ffffff80080c91d8>] worker_thread+0x220/0x340
[  396.404510,0] [<ffffff80080cd864>] kthread+0x11c/0x12c
[  396.409632,0] [<ffffff8008084934>] ret_from_fork+0x10/0x18

Change-Id: I4bf5584143b8434ff5a99c7c9855bf74616da39f
Signed-off-by: a17671 <a17671@motorola.com>
Reviewed-on: https://gerrit.mot.com/1279212
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
---

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d4f3d35e0291..3b0094f72a56 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1487,6 +1487,8 @@ int xhci_hub_check_speed(struct usb_hcd *hcd)
 	for (i = 0; i < MAX_HC_SLOTS; i++) {
 		if (!xhci->devs[i])
 			continue;
+		if (!xhci->devs[i]->udev)
+			continue;
 		speed = xhci->devs[i]->udev->speed;
 		if (speed >= USB_SPEED_SUPER) {
 			return 1;