From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 26 Jan 2016 15:50:12 +0000 (+0200)
Subject: xhci: Fix list corruption in urb dequeue at host removal
X-Git-Tag: v3.2.78~26
X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83c428427da37fc295a68ee8d08e5ca13950627c;p=pandora-kernel.git

xhci: Fix list corruption in urb dequeue at host removal

commit 5c82171167adb8e4ac77b91a42cd49fb211a81a0 upstream.

xhci driver frees data for all devices, both usb2 and and usb3 the
first time usb_remove_hcd() is called, including td_list and and xhci_ring
structures.

When usb_remove_hcd() is called a second time for the second xhci bus it
will try to dequeue all pending urbs, and touches td_list which is already
freed for that endpoint.

Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---

Reading git-diff-tree failed