Patch "usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: AMAN DEEP <[email protected]>
Date: Tue, 21 Jul 2015 17:20:27 +0300
Subject: usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function

From: AMAN DEEP <[email protected]>

commit 3496810663922617d4b706ef2780c279252ddd6a upstream.

virt_dev->num_cached_rings counts on freed ring and is not updated correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring is added into cache and then num_rings_cache is incremented as below:

		virt_dev->ring_cache[rings_cached] =
			virt_dev->eps[ep_index].ring;
		virt_dev->num_rings_cached++;

here, free ring pointer is added to a current index and then index is incremented.
So current index always points to empty location in the ring cache. For getting available free ring, current index should be decremented first and then corresponding ring buffer value should be taken from ring cache.

But In function xhci_endpoint_init(), the num_rings_cached index is accessed before decrement.

		virt_dev->eps[ep_index].new_ring =
			virt_dev->ring_cache[virt_dev->num_rings_cached];
		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
		virt_dev->num_rings_cached--;
This is bug in manipulating the index of ring cache.
And it should be as below:
		virt_dev->num_rings_cached--;
		virt_dev->eps[ep_index].new_ring =
			virt_dev->ring_cache[virt_dev->num_rings_cached];
		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;

---
 drivers/usb/host/xhci-mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1400,10 +1400,10 @@ int xhci_endpoint_init(struct xhci_hcd *
 		/* Attempt to use the ring cache */
 		if (virt_dev->num_rings_cached == 0)
 			return -ENOMEM;
+		virt_dev->num_rings_cached--;
 		virt_dev->eps[ep_index].new_ring =
 			virt_dev->ring_cache[virt_dev->num_rings_cached];
 		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-		virt_dev->num_rings_cached--;
 		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
 					1, type);
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch