From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49181 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754235AbcBXDdn (ORCPT ); Tue, 23 Feb 2016 22:33:43 -0500 Subject: Patch "xhci: Fix list corruption in urb dequeue at host removal" has been added to the 3.10-stable tree To: mathias.nyman@linux.intel.com, gregkh@linuxfoundation.org, joe.lawrence@stratus.com Cc: , From: Date: Tue, 23 Feb 2016 19:23:24 -0800 Message-ID: <14562842042512@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled xhci: Fix list corruption in urb dequeue at host removal to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xhci-fix-list-corruption-in-urb-dequeue-at-host-removal.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 5c82171167adb8e4ac77b91a42cd49fb211a81a0 Mon Sep 17 00:00:00 2001 From: Mathias Nyman Date: Tue, 26 Jan 2016 17:50:12 +0200 Subject: xhci: Fix list corruption in urb dequeue at host removal From: Mathias Nyman commit 5c82171167adb8e4ac77b91a42cd49fb211a81a0 upstream. xhci driver frees data for all devices, both usb2 and and usb3 the first time usb_remove_hcd() is called, including td_list and and xhci_ring structures. When usb_remove_hcd() is called a second time for the second xhci bus it will try to dequeue all pending urbs, and touches td_list which is already freed for that endpoint. Reported-by: Joe Lawrence Tested-by: Joe Lawrence Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman --- drivers/usb/host/xhci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1502,7 +1502,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) { xhci_dbg(xhci, "HW died, freeing TD.\n"); urb_priv = urb->hcpriv; - for (i = urb_priv->td_cnt; i < urb_priv->length; i++) { + for (i = urb_priv->td_cnt; + i < urb_priv->length && xhci->devs[urb->dev->slot_id]; + i++) { td = urb_priv->td[i]; if (!list_empty(&td->td_list)) list_del_init(&td->td_list); Patches currently in stable-queue which might be from mathias.nyman@linux.intel.com are queue-3.10/xhci-fix-list-corruption-in-urb-dequeue-at-host-removal.patch