Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-10-06 22:05:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/usbhost: Check for the device before allocating an endpoint.

Browse source 
A root hub port whose enumeration failed is enumerated again, and the slot
the failed attempt used has been given back by then, so the port has no
device context behind it.  xhci_epalloc() took that pointer and wrote the
new endpoint through it without looking, so the retry stored through NULL
and took the system down in answer to a device that had merely failed to
come up.

Check for the device, and free the endpoint that has no home rather than
leaking it.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Justin Hammond <justin@dynam.ac>
This commit is contained in:
Justin Hammond 2026-08-16 17:17:15 +08:00 • committed by Xiang Xiao
parent a11cecd100
commit 62a7507427
1 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
drivers/usbhost/usbhost_xhci.c
View file

@ -3949,9 +3949,23 @@ static int xhci_epalloc(FAR struct usbhost_driver_s *drvr,
/* xhci_epno_get() returns Device Context Index (DCI) */
idx = xhci_epno_get(epinfo);
mask = XHCI_IN_CTX1_A(XHCI_EP_FLAG(idx));
dev = rhport->dev;
idx = xhci_epno_get(epinfo);
mask = XHCI_IN_CTX1_A(XHCI_EP_FLAG(idx));
dev = rhport->dev;
/* There has to be a device to hang the endpoint off. A port whose
* enumeration failed is retried after its slot has been given back, so
* this can run for a root hub port with nothing behind it.
*/
if (dev == NULL)
{
uerr("no device on port %d\n", RHPNDX(rhport));
nxsem_destroy(&epinfo->iocsem);
kmm_free(epinfo);
return -ENODEV;
}
dev->epinfo[idx - 1] = epinfo;
/* TD rings already allocated but not connected yet. */