https://github.com/torvalds/linux
Revision bcf42aa60c2832510b9be0f30c090bfd35bb172d authored by Mathias Nyman on 07 September 2016, 14:26:33 UTC, committed by Greg Kroah-Hartman on 08 September 2016, 06:39:46 UTC
The stop endpoint command has its own 5 second timeout timer.
If the timeout function is triggered between USB3 and USB2 host
removal it will try to call usb_hc_died(xhci_to_hcd(xhci)->primary_hcd)

the ->primary_hcd will be set to NULL at USB3 hcd removal.

Fix this by first checking if the PCI host is being removed, and
also by using only xhci_to_hcd() as it will always return the primary
hcd.

CC: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent c693593
History
Tip revision: bcf42aa60c2832510b9be0f30c090bfd35bb172d authored by Mathias Nyman on 07 September 2016, 14:26:33 UTC
xhci: fix null pointer dereference in stop command timeout function
Tip revision: bcf42aa

back to top