diff options
| author | Niklas Neronin <niklas.neronin@linux.intel.com> | 2024-04-29 17:02:37 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-11 13:49:06 +0300 |
| commit | 9a24eb8010c2dc6a2eba56e3eb9fc07d14ffe00a (patch) | |
| tree | eff6538fb30a58ffa6474253ff81f1a68033720b /drivers/usb/host | |
| parent | c727e46f0cc8bd81788bb29dac9a0a45f2dfa2eb (diff) | |
| download | linux-9a24eb8010c2dc6a2eba56e3eb9fc07d14ffe00a.tar.xz | |
usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB
[ Upstream commit 66cb618bf0bb82859875b00eeffaf223557cb416 ]
Some transfer events don't always point to a TRB, and consequently don't
have a endpoint ring. In these cases, function handle_tx_event() should
not proceed, because if 'ep->skip' is set, the pointer to the endpoint
ring is used.
To prevent a potential failure and make the code logical, return after
checking the completion code for a Transfer event without TRBs.
Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/usb/host')
| -rw-r--r-- | drivers/usb/host/xhci-ring.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 8dd85221cd92..592dabc78515 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2649,16 +2649,17 @@ static int handle_tx_event(struct xhci_hcd *xhci, else xhci_handle_halted_endpoint(xhci, ep, NULL, EP_SOFT_RESET); - goto cleanup; + break; case COMP_RING_UNDERRUN: case COMP_RING_OVERRUN: case COMP_STOPPED_LENGTH_INVALID: - goto cleanup; + break; default: xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n", slot_id, ep_index); goto err_out; } + return 0; } /* Count current td numbers if ep->skip is set */ |