From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41222 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751437AbdJ3JCy (ORCPT ); Mon, 30 Oct 2017 05:02:54 -0400 Date: Mon, 30 Oct 2017 10:03:06 +0100 From: Greg KH To: Jack Pham Cc: mrana@codeaurora.org, mathias.nyman@linux.intel.com, stable@vger.kernel.org Subject: Re: [PATCH] usb: xhci: Handle error condition in xhci_stop_device() Message-ID: <20171030090306.GA29237@kroah.com> References: <20171024102237.GA7323@kroah.com> <20171024161619.3536-1-jackp@codeaurora.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171024161619.3536-1-jackp@codeaurora.org> Sender: stable-owner@vger.kernel.org List-ID: On Tue, Oct 24, 2017 at 09:16:19AM -0700, Jack Pham wrote: > From: Mayank Rana > > commit b3207c65dfafae27e7c492cb9188c0dc0eeaf3fd upstream. > > xhci_stop_device() calls xhci_queue_stop_endpoint() multiple times > without checking the return value. xhci_queue_stop_endpoint() can > return error if the HC is already halted or unable to queue commands. > This can cause a deadlock condition as xhci_stop_device() would > end up waiting indefinitely for a completion for the command that > didn't get queued. Fix this by checking the return value and bailing > out of xhci_stop_device() in case of error. This patch happens to fix > potential memory leaks of the allocated command structures as well. > > Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,") > Signed-off-by: Mayank Rana > Signed-off-by: Jack Pham > Signed-off-by: Mathias Nyman > Signed-off-by: Greg Kroah-Hartman > --- > Hi Greg, > > I tested that this applies cleanly to 3.18.y, 4.4.y and 4.9.y. Thanks for the patch, now queued up. greg k-h