• Sarah Sharp's avatar
    USB: xhci: Fix TRB physical to virtual address translation. · 2fa88daa
    Sarah Sharp authored
    The trb_in_td() function in the xHCI driver is supposed to translate a
    physical transfer buffer request (TRB) into a virtual pointer to the ring
    segment that TRB is in.
    
    Unfortunately, a mistake in this function may cause endless loops as the
    driver searches through the linked list of ring segments over and over
    again.  Fix a couple bugs that may lead to loops or bad output:
    
    1. Bail out if we get a NULL pointer when translating the segment's
    private structure and the starting DMA address of the segment chunk.  If
    this happens, we've been handed a starting TRB pointer from a different
    ring.
    
    2. Make sure the function works when there's multiple segments in the
    ring.  In the while loop to search through the ring segments, use the
    current segment variable (cur_seg), rather than the starting segment
    variable (start_seg) that is passed in.
    
    3. Stop searching the ring if we've run through all the segments in the
    ring.
    Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
    Cc: stable <stable@kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
    2fa88daa
xhci-ring.c 64.9 KB