From: Alan Stern <stern@rowland.harvard.edu>
Date: Mon, 31 Jan 2011 15:56:37 +0000 (-0500)
Subject: USB: prevent buggy hubs from crashing the USB stack
X-Git-Tag: v2.6.34.10~229
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d9b6d292c16e384d0b746d421556955667786c43;p=thirdparty%2Fkernel%2Fstable.git

USB: prevent buggy hubs from crashing the USB stack

commit d199c96d41d80a567493e12b8e96ea056a1350c1 upstream.

If anyone comes across a high-speed hub that (by mistake or by design)
claims to have no Transaction Translators, plugging a full- or
low-speed device into it will cause the USB stack to crash.  This
patch (as1446) prevents the problem by ignoring such devices, since
the kernel has no way to communicate with them.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Perry Neben <neben@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5b63c45273f1d..f4e54bae4a075 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2710,6 +2710,11 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
 		udev->ttport = hdev->ttport;
 	} else if (udev->speed != USB_SPEED_HIGH
 			&& hdev->speed == USB_SPEED_HIGH) {
+		if (!hub->tt.hub) {
+			dev_err(&udev->dev, "parent hub has no TT\n");
+			retval = -EINVAL;
+			goto fail;
+		}
 		udev->tt = &hub->tt;
 		udev->ttport = port1;
 	}