Mathias Nyman fe465003bb xhci: fix possible null pointer dereference at secondary interrupter removal ...

commit a54a594d72f25b08f39d743880a76721fba9ae77 upstream.

Don't try to remove a secondary interrupter that is known to be invalid.
Also check if the interrupter is valid inside the spinlock that protects
the array of interrupters.

Found by smatch static checker

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-usb/ffaa0a1b-5984-4a1f-bfd3-9184630a97b9@moroto.mountain/
Fixes: c99b38c41234 ("xhci: add support to allocate several interrupters")
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240125152737.2983959-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-05-09 09:44:08 +02:00

..

accel

accel/qaic: Fix integer overflow in qaic_validate_req()

2025-03-28 21:59:54 +01:00

accessibility

speakup: Fix sizeof() vs ARRAY_SIZE() bug

2024-06-12 11:11:18 +02:00

acpi

ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls

2025-05-02 07:50:58 +02:00

amba

…

android

binder: fix UAF caused by offsets overwrite

2024-09-12 11:11:41 +02:00

ata

ata: libata-scsi: Fix ata_msense_control_ata_feature()

2025-05-02 07:50:48 +02:00

atm

atm: idt77252: prevent use after free in dequeue_rx()

2024-08-29 17:33:18 +02:00

auxdisplay

auxdisplay: hd44780: Fix an API misuse in hd44780.c

2025-05-02 07:50:38 +02:00

base

drivers: base: handle module_kobject creation

2025-05-09 09:44:07 +02:00

bcma

…

block

loop: aio inherit the ioprio of original request

2025-05-02 07:51:01 +02:00

bluetooth

Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

2025-05-09 09:43:57 +02:00

bus

bus: mhi: host: Fix race between unprepare and queue_buf

2025-04-25 10:45:26 +02:00

cache

cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback()

2024-03-01 13:35:08 +01:00

cdrom

cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()

2024-11-01 01:58:25 +01:00

cdx

cdx: Fix possible UAF error in driver_override_show()

2025-03-13 12:58:36 +01:00

char

char: misc: register chrdev region with all possible minors

2025-05-02 07:50:49 +02:00

clk

clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()

2025-05-02 07:50:53 +02:00

clocksource

clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup

2025-04-25 10:45:25 +02:00

comedi

comedi: jr3_pci: Fix synchronous deletion of timer

2025-05-02 07:51:03 +02:00

connector

connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared"

2024-02-23 09:25:01 +01:00

counter

counter: microchip-tcb-capture: Fix undefined counter channel state on probe

2025-04-07 10:06:37 +02:00

cpufreq

cpufreq: Fix setting policy limits when frequency tables are used

2025-05-09 09:43:53 +02:00

cpuidle

cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu

2025-01-17 13:36:16 +01:00

crypto

crypto: ccp - Add support for PCI device 0x1134

2025-05-02 07:50:52 +02:00

cxl

cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports

2025-05-02 07:50:47 +02:00

dax

dax: delete a stale directory pmem

2024-12-09 10:32:21 +01:00

dca

…

devfreq

PM / devfreq: Synchronize devfreq_monitor_[start/stop]

2024-02-05 20:14:15 +00:00

dio

…

dma

dmaengine: dmatest: Fix dmatest waiting less when interrupted

2025-05-02 07:50:55 +02:00

dma-buf

udmabuf: fix a buf size overflow issue during udmabuf creation

2025-05-02 07:50:57 +02:00

edac

EDAC/altera: Set DDR and SDMMC interrupt mask before registration

2025-05-09 09:43:50 +02:00

eisa

…

extcon

extcon: max8997: select IRQ_DOMAIN instead of depending on it

2024-06-12 11:12:27 +02:00

firewire

firewire: core: correct range of block for case of switch statement

2024-10-04 16:29:28 +02:00

firmware

firmware: arm_ffa: Skip Rx buffer ownership release if not acquired

2025-05-09 09:44:04 +02:00

fpga

fpga: region: add owner module and take its refcount

2024-06-12 11:12:23 +02:00

fsi

…

gnss

…

gpio

gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment

2025-05-02 07:50:59 +02:00

gpu

drm/amd/display: Fix slab-use-after-free in hdcp

2025-05-09 09:44:07 +02:00

greybus

greybus: Fix use-after-free bug in gb_interface_release due to race condition.

2024-06-21 14:38:48 +02:00

hid

HID: pidff: Fix null pointer dereference in pidff_find_fields

2025-04-25 10:45:12 +02:00

hsi

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

2025-04-25 10:45:38 +02:00

hte

…

hv

Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()

2025-03-22 12:50:38 -07:00

hwmon

hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}

2025-04-10 14:37:38 +02:00

hwspinlock

hwspinlock: Introduce hwspin_lock_bust()

2024-09-08 07:54:43 +02:00

hwtracing

coresight-etm4x: add isb() before reading the TRCSTATR

2025-04-10 14:37:32 +02:00

i2c

i2c: imx-lpi2c: Fix clock count when probe defers

2025-05-09 09:43:50 +02:00

i3c

i3c: Add NULL pointer check in i3c_master_queue_ibi()

2025-04-25 10:45:28 +02:00

idle

intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly

2025-03-07 16:45:49 +01:00

iio

iio: adc: ad7768-1: Fix conversion result sign

2025-05-02 07:50:39 +02:00

infiniband

qibfs: fix _another_ leak

2025-05-02 07:50:56 +02:00

input

Input: i8042 - swap old quirk combination with new quirk for more devices

2025-03-22 12:50:46 -07:00

interconnect

interconnect: icc-clk: Add missed num_nodes initialization

2024-10-04 16:29:40 +02:00

iommu

iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids

2025-05-09 09:44:07 +02:00

ipack

…

irqchip

irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs

2025-05-09 09:43:51 +02:00

isdn

mISDN: fix MISDN_TIME_STAMP handling

2024-08-19 06:04:28 +02:00

leds

leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs

2025-04-25 10:45:28 +02:00

macintosh

macintosh/therm_windtunnel: fix module unload.

2024-08-03 08:54:02 +02:00

mailbox

mailbox: pcc: Always clear the platform ack interrupt first

2025-05-02 07:50:54 +02:00

mcb

mcb: fix a double free bug in chameleon_parse_gdd()

2025-05-02 07:50:47 +02:00

md

dm: always update the array size in realloc_argv on success

2025-05-09 09:43:52 +02:00

media

media: vimc: skip .s_stream() for stopped entities

2025-05-02 07:50:37 +02:00

memory

memory: omap-gpmc: drop no compatible check

2025-04-10 14:37:38 +02:00

memstick

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

2025-04-07 10:06:37 +02:00

message

scsi: fusion: Remove unused variable 'rc'

2024-12-09 10:32:18 +01:00

mfd

mfd: ene-kb3930: Fix a potential NULL pointer dereference

2025-04-25 10:45:28 +02:00

misc

objtool, lkdtm: Obfuscate the do_nothing() pointer

2025-05-02 07:50:56 +02:00

mmc

mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe

2025-05-09 09:43:51 +02:00

most

…

mtd

mtd: rawnand: Add status chack in r852_ready()

2025-04-25 10:45:29 +02:00

mux

…

net

net: vertexcom: mse102x: Fix RX error handling

2025-05-09 09:44:03 +02:00

nfc

nfc: pn533: Add poll mod list filling check

2024-09-04 13:28:28 +02:00

ntb

ntb_hw_amd: Add NTB PCI ID for new gen CPU

2025-05-02 07:50:56 +02:00

nubus

…

nvdimm

nvdimm: rectify the illogical code within nd_dax_probe()

2024-12-14 20:00:13 +01:00

nvme

nvme-tcp: fix premature queue removal and I/O failover

2025-05-09 09:44:01 +02:00

nvmem

nvmem: imx-ocotp-ele: fix MAC address byte order

2025-02-27 04:10:47 -08:00

of

of: resolver: Fix device node refcount leakage in of_resolve_phandles()

2025-05-02 07:50:41 +02:00

opp

OPP: OF: Fix an OF node leak in _opp_add_static_v2()

2025-02-08 09:51:55 +01:00

parisc

Revert "change alloc_pages name in dma_map_ops to avoid name conflicts"

2024-09-04 13:28:24 +02:00

parport

parport: Proper fix for array out-of-bounds access

2024-10-22 15:46:33 +02:00

pci

PCI: imx6: Skip controller_id generation logic for i.MX7D

2025-05-09 09:43:55 +02:00

pcmcia

pcmcia: Use resource_size function on resource object

2024-09-12 11:11:31 +02:00

peci

…

perf

perf: arm_pmu: Don't disable counter in armpmu_add()

2025-04-25 10:45:10 +02:00

phy

phy: freescale: imx8m-pcie: assert phy reset and perst in power off

2025-04-25 10:45:36 +02:00

pinctrl

pinctrl: renesas: rza2: Fix potential NULL pointer dereference

2025-05-02 07:50:52 +02:00

platform

platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug

2025-05-09 09:43:53 +02:00

pmdomain

pmdomain: imx8mp-blk-ctrl: add missing loop break condition

2025-01-23 17:21:17 +01:00

pnp

PNP: ACPI: fix fortify warning

2024-02-05 20:14:15 +00:00

power

power: supply: max77693: Fix wrong conversion of charge input threshold value

2025-04-10 14:37:31 +02:00

powercap

powercap: call put_device() on an error path in powercap_register_control_type()

2025-03-22 12:50:40 -07:00

pps

pps: Fix a use-after-free

2025-02-08 09:52:38 +01:00

ps3

…

ptp

ptp: ocp: fix start time alignment in ptp_ocp_signal_set

2025-04-25 10:45:44 +02:00

pwm

pwm: fsl-ftm: Handle clk_get_rate() returning 0

2025-04-25 10:45:21 +02:00

rapidio

rapidio: fix an API misues when rio_add_net() fails

2025-03-13 12:58:27 +01:00

ras

…

regulator

objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc()

2025-05-02 07:50:56 +02:00

remoteproc

remoteproc: qcom_q6v5_mss: Handle platforms with one power domain

2025-04-10 14:37:31 +02:00

reset

reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC

2025-04-07 10:06:36 +02:00

rpmsg

rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length

2024-12-09 10:32:29 +01:00

rtc

rtc: pcf85063: do a SW reset if POR failed

2025-05-02 07:50:57 +02:00

s390

s390/tty: Fix a potential memory leak bug

2025-05-02 07:50:53 +02:00

sbus

…

scsi

scsi: pm80xx: Set phy_attached to zero when device is gone

2025-05-02 07:51:01 +02:00

sh

sh: intc: Fix use-after-free bug in register_intc_controller()

2024-12-09 10:33:00 +01:00

siox

…

slimbus

slimbus: messaging: Free transaction ID in delayed interrupt scenario

2025-03-13 12:58:37 +01:00

soc

soc: qcom: ice: introduce devm_of_qcom_ice_get

2025-05-02 07:50:37 +02:00

soundwire

soundwire: slave: fix an OF node reference leak in soundwire slave device

2025-04-10 14:37:32 +02:00

spi

spi: tegra114: Don't fail set_cs_timing when delays are zero

2025-05-09 09:43:51 +02:00

spmi

spmi: hisi-spmi-controller: Do not override device identifier

2024-06-21 14:38:40 +02:00

ssb

ssb: Fix division by zero issue in ssb_calc_clock_rate

2024-08-29 17:33:22 +02:00

staging

staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES

2025-04-10 14:37:34 +02:00

target

scsi: target: spc: Fix RSOC parameter data header size

2025-04-25 10:45:14 +02:00

tc

…

tee

tee: optee: Fix supplicant wait loop

2025-02-27 04:10:51 -08:00

thermal

thermal/drivers/rockchip: Add missing rk3328 mapping entry

2025-04-25 10:45:32 +02:00

thunderbolt

thunderbolt: Scan retimers after device router has been enumerated

2025-05-02 07:50:55 +02:00

tty

serial: sifive: lock port in startup()/shutdown() callbacks

2025-05-02 07:50:49 +02:00

ufs

scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init()

2025-05-02 07:51:01 +02:00

uio

Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic

2024-09-12 11:11:41 +02:00

usb

xhci: fix possible null pointer dereference at secondary interrupter removal

2025-05-09 09:44:08 +02:00

vdpa

vdpa/mlx5: Fix oversized null mkey longer than 32bit

2025-04-25 10:45:27 +02:00

vfio

Revert "vfio/platform: check the bounds of read/write syscalls"

2025-02-21 13:57:27 +01:00

vhost

vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint

2025-04-10 14:37:32 +02:00

video

backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()

2025-04-25 10:45:30 +02:00

virt

drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

2025-03-13 12:58:37 +01:00

virtio

virtio_ring: fix KMSAN error for premapped mode

2024-09-12 11:11:36 +02:00

vlynq

…

w1

nvmem: add explicit config option to read old syntax fixed OF cells

2024-05-17 12:01:55 +02:00

watchdog

watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()

2025-02-08 09:52:25 +01:00

xen

xen: Change xen-acpi-processor dom0 dependency

2025-05-02 07:50:58 +02:00

zorro

…

Kconfig

…

Makefile

…