Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

xhci: Fix NULL pointer dereference when reading portli debugfs files

Michal reported and debgged a NULL pointer dereference bug in the
recently added portli debugfs files

Oops is caused when there are more port registers counted in
xhci->max_ports than ports reported by Supported Protocol capabilities.
This is possible if max_ports is more than maximum port number, or
if there are gaps between ports of different speeds the 'Supported
Protocol' capabilities.

In such cases port->rhub will be NULL so we can't reach xhci behind it.
Add an explicit NULL check for this case, and print portli in hex
without dereferencing port->rhub.

Reported-by: Michal Pecio <michal.pecio@gmail.com>
Closes: https://lore.kernel.org/linux-usb/20260304103856.48b785fd.michal.pecio@gmail.com
Fixes: 384c57ec7205 ("usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register.")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260304223639.3882398-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Mathias Nyman and committed by
Greg Kroah-Hartman
ae4ff9de d6d5febd

+9 -1
+9 -1
drivers/usb/host/xhci-debugfs.c
··· 386 386 static int xhci_portli_show(struct seq_file *s, void *unused) 387 387 { 388 388 struct xhci_port *port = s->private; 389 - struct xhci_hcd *xhci = hcd_to_xhci(port->rhub->hcd); 389 + struct xhci_hcd *xhci; 390 390 u32 portli; 391 391 392 392 portli = readl(&port->port_reg->portli); 393 + 394 + /* port without protocol capability isn't added to a roothub */ 395 + if (!port->rhub) { 396 + seq_printf(s, "0x%08x\n", portli); 397 + return 0; 398 + } 399 + 400 + xhci = hcd_to_xhci(port->rhub->hcd); 393 401 394 402 /* PORTLI fields are valid if port is a USB3 or eUSB2V2 port */ 395 403 if (port->rhub == &xhci->usb3_rhub)