Commit 296fcdab authored by Lalithambika Krishna Kumar's avatar Lalithambika Krishna Kumar Committed by Greg Kroah-Hartman
Browse files

xhci: check slot_id is valid before gathering slot info 



Check that the slot_id that we dug out from command completion event
TRB, is valid before using it to identify the slot associated with the
command that generated the event.

Signed-off-by: default avatarLalithambika Krishna Kumar <lalithambika.krishnakumar@intel.com>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210129130044.206855-11-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 04d21f72

drivers/usb/host/xhci-ring.c

+6 −1
Original line number Diff line number Diff line
@@ -1430,7 +1430,7 @@ void xhci_handle_command_timeout(struct work_struct *work) 
static void handle_cmd_completion(struct xhci_hcd *xhci,

		struct xhci_event_cmd *event)

{

	int slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));

	unsigned int slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));

	u64 cmd_dma;

	dma_addr_t cmd_dequeue_dma;

	u32 cmd_comp_code;
@@ -1438,6 +1438,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, 
	struct xhci_command *cmd;

	u32 cmd_type;



	if (slot_id >= MAX_HC_SLOTS) {

		xhci_warn(xhci, "Invalid slot_id %u\n", slot_id);

		return;

	}



	cmd_dma = le64_to_cpu(event->cmd_trb);

	cmd_trb = xhci->cmd_ring->dequeue;