[lkml]   [2009]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[111/136] USB: xhci: Dont touch xhci_td after its freed.
2.6.31-stable review patch.  If anyone has any objections, please let us know.

From: Sarah Sharp <>

commit 9191eee7b8a0e18c07c06d6da502706805cab6d2 upstream.

On a successful transfer, urb->td is freed before the URB is ready to be
given back to the driver. Don't touch urb->td after it's freed. This bug
would have only shown up when xHCI debugging was turned on, and the freed
memory was quickly reused for something else.

Signed-off-by: Sarah Sharp <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/usb/host/xhci-ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1193,7 +1193,7 @@ cleanup:
if (urb) {
usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",
- urb, td->urb->actual_length, status);
+ urb, urb->actual_length, status);
usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);

 \ /
  Last update: 2009-10-02 03:45    [W:0.287 / U:10.428 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site