usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

Some transfer events don't always point to a TRB, and consequently don't
have a endpoint ring. In these cases, function handle_tx_event() should
not proceed, because if 'ep->skip' is set, the pointer to the endpoint
ring is used.

To prevent a potential failure and make the code logical, return after
checking the completion code for a Transfer event without TRBs.

Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 07c529e072c9e140f6e03ffb34fb7722513badb2..00f48dd197ac00ffab4b55b5c19173029bfc8ce9 100644 (file)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2625,16 +2625,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                        else
                                xhci_handle_halted_endpoint(xhci, ep, NULL,
                                                            EP_SOFT_RESET);
-                       goto cleanup;
+                       break;
                case COMP_RING_UNDERRUN:
                case COMP_RING_OVERRUN:
                case COMP_STOPPED_LENGTH_INVALID:
-                       goto cleanup;
+                       break;
                default:
                        xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
                                 slot_id, ep_index);
                        goto err_out;
                }
+               return 0;
        }
 
        /* Count current td numbers if ep->skip is set */