[EDT][PATCH] USB XHCI: Bugfix for NULL pointer deference in xhci_endpoint_init() function

[AMAN DEEP]

EP-D52BC23FD00D4E2BBEED88BA6AF8C4AC 

virt_dev->num_cached_rings counts on freed ring and 
is not updated correctly. In xhci_free_or_cache_endpoint_ring() function, 
the free ring is added into cache and then 
num_rings_cache is incremented as below:
                virt_dev->ring_cache[rings_cached] =
                        virt_dev->eps[ep_index].ring;
                virt_dev->num_rings_cached++;
here, free ring pointer is added to a current index and then 
index is incremented.
So current index always points to empty location in the ring cache.
For getting available free ring, 
current index should be decremented first and then
corresponding ring buffer value should be taken from ring cache.

But In function xhci_endpoint_init(), 
the num_rings_cached index is accessed before decrement.
                virt_dev->eps[ep_index].new_ring =
                        virt_dev->ring_cache[virt_dev->num_rings_cached];
                virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
                virt_dev->num_rings_cached--;
This is bug in manipulating the index of ring cache.
And it should be as below:
                virt_dev->num_rings_cached--;
                virt_dev->eps[ep_index].new_ring =
                        virt_dev->ring_cache[virt_dev->num_rings_cached];
                virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;

Signed-off-by: Aman Deep <aman.d...@samsung.com>
---
 drivers/usb/host/xhci-mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index f833640..3e442f7 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                /* Attempt to use the ring cache */
                if (virt_dev->num_rings_cached == 0)
                        return -ENOMEM;
+               virt_dev->num_rings_cached--;
                virt_dev->eps[ep_index].new_ring =
                        virt_dev->ring_cache[virt_dev->num_rings_cached];
                virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-               virt_dev->num_rings_cached--;
                xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
                                        1, type);
        }
-- 
1.7.9.5