USB: xhci: Fix issue with set interface after stall.

commit 1624ae1c19e227096ba85bfc389d9b99cb6f7dde upstream.

When the USB core installs a new interface, it unconditionally clears the
halts on all the endpoints on the new interface.  Usually the xHCI host
needs to know when an endpoint is reset, so it can change its internal
endpoint state.  In this case, it doesn't care, because the endpoints were
never halted in the first place.

To avoid issuing a redundant Reset Endpoint command, the xHCI driver looks
at xhci_virt_ep->stopped_td to determine if the endpoint was actually
halted.  However, the functions that handle the stall never set that
variable to NULL after it dealt with the stall.  So if an endpoint stalled
and a Reset Endpoint command completed, and then the class driver tried to
install a new alternate setting, the xHCI driver would access the old
xhci_virt_ep->stopped_td pointer.  A similar problem occurs if the
endpoint has been stopped to cancel a transfer.

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
index 9974f32beeeebd57ca1976a9c637a30287e3c4e4..ee8042e6424429c96664af330c2c974164f1f02c 100644 (file)
--- a/drivers/usb/host/xhci-hcd.c
+++ b/drivers/usb/host/xhci-hcd.c
@@ -1414,6 +1414,8 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
                kfree(virt_ep->stopped_td);
                xhci_ring_cmd_db(xhci);
        }
+       virt_ep->stopped_td = NULL;
+       virt_ep->stopped_trb = NULL;
        spin_unlock_irqrestore(&xhci->lock, flags);
 
        if (ret)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 821b7b4709de6531b28afb78c428ad4f5379ff81..2a4ed82750709cb3d73ad8c337fd48627f3b6b57 100644 (file)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -548,6 +548,8 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
                /* Otherwise just ring the doorbell to restart the ring */
                ring_ep_doorbell(xhci, slot_id, ep_index);
        }
+       ep->stopped_td = NULL;
+       ep->stopped_trb = NULL;
 
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1065,8 +1067,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 
                        ep->stopped_td = td;
                        ep->stopped_trb = event_trb;
+
                        xhci_queue_reset_ep(xhci, slot_id, ep_index);
                        xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
+
+                       ep->stopped_td = NULL;
+                       ep->stopped_trb = NULL;
+
                        xhci_ring_cmd_db(xhci);
                        goto td_cleanup;
                default: