• Sarah Sharp's avatar
    xhci: Fix potential NULL ptr deref in command cancellation. · 43a09f7f
    Sarah Sharp authored
    The command cancellation code doesn't check whether find_trb_seg()
    couldn't find the segment that contains the TRB to be canceled.  This
    could cause a NULL pointer deference later in the function when next_trb
    is called.  It's unlikely to happen unless something is wrong with the
    command ring pointers, so add some debugging in case it happens.
    
    This patch should be backported to stable kernels as old as 3.0, that
    contain the commit b63f4053 "xHCI:
    handle command after aborting the command ring".
    Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
    Cc: stable@vger.kernel.org
    43a09f7f
xhci-ring.c 122 KB