xhci: Fix root hub port null pointer dereference in xhci tracepoints
authorMathias Nyman <mathias.nyman@linux.intel.com>
Thu, 4 Apr 2024 12:11:06 +0000 (15:11 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Apr 2024 12:54:54 +0000 (14:54 +0200)
commitdda7e89e53d6ebf27c49df7d87a54e3e1614d332
treea17f82d9e9d71c0e89658fb2463c529c2b74a80e
parent5bfc311dd6c376d350b39028b9000ad766ddc934
xhci: Fix root hub port null pointer dereference in xhci tracepoints

The pointer from a xhci usb virt device to its root hub port
(vdev->rhub_port) is set later when device is addressed, not while
vdev is allocated.

Tracepoints dereferenced this rhub_port pointer when freeing the virt
device, which causes null pointer dereference if tracing is enabled
and device is freed before addressed.

This can happen if tracing is enabled and xhci driver is unloaded before
a device is fully enumerated, or initial enumeration fails and device
is reset and freed before retry.

Don't dereference the rhub_port or show port numbers when tracing
xhci_free_virt_device(). This info is not very useful anyway.

Print the more useful slot id instead

Fixes: 06790c19086f ("xhci: replace real & fake port with pointer to root hub port")
Reported-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Closes: https://lore.kernel.org/linux-usb/20240402005007.klv2ij727fkz7rpd@synopsys.com/
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240404121106.2842417-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci-trace.h