xhci: Fix NULL pointer dereference when reading portli debugfs files

Michal reported and debgged a NULL pointer dereference bug in the
recently added portli debugfs files

Oops is caused when there are more port registers counted in
xhci->max_ports than ports reported by Supported Protocol capabilities.
This is possible if max_ports is more than maximum port number, or
if there are gaps between ports of different speeds the 'Supported
Protocol' capabilities.

In such cases port->rhub will be NULL so we can't reach xhci behind it.
Add an explicit NULL check for this case, and print portli in hex
without dereferencing port->rhub.

Reported-by: Michal Pecio <michal.pecio@gmail.com>
Closes: https://lore.kernel.org/linux-usb/20260304103856.48b785fd.michal.pecio@gmail.com
Fixes: 384c57ec7205 ("usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register.")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260304223639.3882398-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 890fc5e892f1be3cc469fef062f4d7c07b082d2a..ade178ab34a786eb962d33e99a2dad876d0bbda1 100644 (file)
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -386,11 +386,19 @@ static const struct file_operations port_fops = {
 static int xhci_portli_show(struct seq_file *s, void *unused)
 {
        struct xhci_port        *port = s->private;
-       struct xhci_hcd         *xhci = hcd_to_xhci(port->rhub->hcd);
+       struct xhci_hcd         *xhci;
        u32                     portli;
 
        portli = readl(&port->port_reg->portli);
 
+       /* port without protocol capability isn't added to a roothub */
+       if (!port->rhub) {
+               seq_printf(s, "0x%08x\n", portli);
+               return 0;
+       }
+
+       xhci = hcd_to_xhci(port->rhub->hcd);
+
        /* PORTLI fields are valid if port is a USB3 or eUSB2V2 port */
        if (port->rhub == &xhci->usb3_rhub)
                seq_printf(s, "0x%08x LEC=%u RLC=%u TLC=%u\n", portli,