[PATCH] usb: xhci: fix USB2 roothub port count clamp

[PATCH] usb: xhci: fix USB2 roothub port count clamp

[Zhang Cen]

xhci_create_rhub_port_array() is passed the roothub whose port array is
being built and the limit that matches that roothub's descriptor size. The
limit check currently stores the clamped value in xhci->usb3_rhub.num_ports
unconditionally.

When this helper handles the USB2 roothub, a controller advertising more
than USB_MAXCHILDREN USB2 ports leaves xhci->usb2_rhub.num_ports unchanged.
Later USB2 hub descriptor and status helpers use that count to size fixed
USB2 descriptor and status bitmaps.

Clamp the roothub passed to the helper so both USB2 and USB3 counts are
bounded before those paths use them.

Fixes: 9a7ad750a8fb ("usb: xhci: move roothub port limit validation")
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>

---
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 997fe90f54e5..2545f96fd1ee 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2182,7 +2182,7 @@ static void xhci_create_rhub_port_array(struct xhci_hcd *xhci, struct xhci_hub *
 	 * descriptors aren't longer than the USB core will allocate.
 	 */
 	if (rhub->num_ports > max_ports) {
-		xhci->usb3_rhub.num_ports = max_ports;
+		rhub->num_ports = max_ports;
 		xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Limiting USB%u root hub ports to %u",
 			       rhub->maj_rev, max_ports);
 	}