Unverified Commit cea781eb authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12170 xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration 

Merge Pull Request from: @ci-robot 
 
PR sync from: Peng Zhang <zhangpeng362@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/P6DMOZGJNNEJOPAR5LPHSDXO6RSFVHFO/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZE 
 
Link:https://gitee.com/openeuler/kernel/pulls/12170

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 5f264976 32eec168

drivers/usb/host/xhci.c

+5 −3
Original line number Diff line number Diff line
@@ -2826,7 +2826,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, 
				xhci->num_active_eps);

		return -ENOMEM;

	}

	if ((xhci->quirks & XHCI_SW_BW_CHECKING) &&

	if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change &&

	    xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) {

		if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK))

			xhci_free_host_resources(xhci, ctrl_ctx);
@@ -4242,8 +4242,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, 
		mutex_unlock(&xhci->mutex);

		ret = xhci_disable_slot(xhci, udev->slot_id);

		xhci_free_virt_device(xhci, udev->slot_id);

		if (!ret)

			xhci_alloc_dev(hcd, udev);

		if (!ret) {

			if (xhci_alloc_dev(hcd, udev) == 1)

				xhci_setup_addressable_virt_dev(xhci, udev);

		}

		kfree(command->completion);

		kfree(command);

		return -EPROTO;