From 62a7507427aa1ba949a51e52b154e5bcbbfcd999 Mon Sep 17 00:00:00 2001 From: Justin Hammond Date: Sun, 16 Aug 2026 17:17:15 +0800 Subject: [PATCH] drivers/usbhost: Check for the device before allocating an endpoint. A root hub port whose enumeration failed is enumerated again, and the slot the failed attempt used has been given back by then, so the port has no device context behind it. xhci_epalloc() took that pointer and wrote the new endpoint through it without looking, so the retry stored through NULL and took the system down in answer to a device that had merely failed to come up. Check for the device, and free the endpoint that has no home rather than leaking it. Assisted-by: Claude:claude-opus-5 Signed-off-by: Justin Hammond --- drivers/usbhost/usbhost_xhci.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/usbhost/usbhost_xhci.c b/drivers/usbhost/usbhost_xhci.c index 7b8c19c2890..5227629d0c5 100644 --- a/drivers/usbhost/usbhost_xhci.c +++ b/drivers/usbhost/usbhost_xhci.c @@ -3949,9 +3949,23 @@ static int xhci_epalloc(FAR struct usbhost_driver_s *drvr, /* xhci_epno_get() returns Device Context Index (DCI) */ - idx = xhci_epno_get(epinfo); - mask = XHCI_IN_CTX1_A(XHCI_EP_FLAG(idx)); - dev = rhport->dev; + idx = xhci_epno_get(epinfo); + mask = XHCI_IN_CTX1_A(XHCI_EP_FLAG(idx)); + dev = rhport->dev; + + /* There has to be a device to hang the endpoint off. A port whose + * enumeration failed is retried after its slot has been given back, so + * this can run for a root hub port with nothing behind it. + */ + + if (dev == NULL) + { + uerr("no device on port %d\n", RHPNDX(rhport)); + nxsem_destroy(&epinfo->iocsem); + kmm_free(epinfo); + return -ENODEV; + } + dev->epinfo[idx - 1] = epinfo; /* TD rings already allocated but not connected yet. */