xhci: Fix NULL pointer dereference when cleaning up streams for removed host

This off by one in stream_id indexing caused NULL pointer dereference and
soft lockup on machines with USB attached SCSI devices connected to a
hotpluggable xhci controller.

The code that cleans up pending URBs for dead hosts tried to dereference
a stream ring at the invalid stream_id 0.
ep->stream_info->stream_rings[0] doesn't point to a ring.

Start looping stream_id from 1 like in all the other places in the driver,
and check that the ring exists before trying to kill URBs on it.

Reported-by: rocko r <rockorequin@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c50c902d009ed8ea634ce073ecff75024ff8cda8..cc368ad2b51e44c731a2926902f78de830e2f17a 100644 (file)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -864,13 +864,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
                        (ep->ep_state & EP_GETTING_NO_STREAMS)) {
                int stream_id;
 
-               for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+               for (stream_id = 1; stream_id < ep->stream_info->num_streams;
                                stream_id++) {
+                       ring = ep->stream_info->stream_rings[stream_id];
+                       if (!ring)
+                               continue;
+
                        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                        "Killing URBs for slot ID %u, ep index %u, stream %u",
-                                       slot_id, ep_index, stream_id + 1);
-                       xhci_kill_ring_urbs(xhci,
-                                       ep->stream_info->stream_rings[stream_id]);
+                                       slot_id, ep_index, stream_id);
+                       xhci_kill_ring_urbs(xhci, ring);
                }
        } else {
                ring = ep->ring;