Re: [BUG] HID: steelseries-arctis: NULL deref in xhci_urb_enqueue from status timer during resume from suspend (Arctis 9) -> system hang

[Michal Pecio <michal.pecio@gmail.com>]

On Tue, 10 Nov 2026 22:46:27 +0200, Olli Salenius wrote:
> Disclaimer, I am not well versed kernel level stuff and using Claude
> Opus 5.5 in debugging this issue, so the following info may not be
> accurate, however the patch did seem to fix the hang at least on a few
> test suspend/resume -cycles.

Your LLM is right. The test patch makes no difference, but commit
555040535 removed the trigger. If you revert 555040535, the crash
will be back.

It happens because xhci_reset_or_discover_device() allocates new
state for the device, but it doesn't bother to update the root hub
pointer, leaving this job to xhci_setup_device().

To fix the crash we need either the dumb patch below or some rework
to preserve more state during resets. Probably the dumb fix is the
only viable short-term option.

It doesn't solve my problem #2, but that one is a race condition,
so much less likely to actually happen in practice.

Regards,
Michal

---

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index e5c8b3a945a6..81656bfdaf66 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1662,6 +1662,11 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 		goto free_priv;
 	}
 
+	if (!xhci->devs[slot_id]->rhub_port) {
+		ret = -EHOSTUNREACH;
+		goto free_priv;
+	}
 	if (xhci->devs[slot_id]->rhub_port->link_inactive) {
 		xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n");
 		ret = -ENODEV;