This is a note to let you know that I've just added the patch titled xhci: fix finding correct bus_state structure for USB 3.1 hosts to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xhci-fix-finding-correct-bus_state-structure-for-usb-3.1-hosts.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 5a838a13c9b4e5dd188b7a6eaeb894e9358ead0c Mon Sep 17 00:00:00 2001 From: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> Date: Mon, 18 Sep 2017 17:39:13 +0300 Subject: xhci: fix finding correct bus_state structure for USB 3.1 hosts From: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> commit 5a838a13c9b4e5dd188b7a6eaeb894e9358ead0c upstream. xhci driver keeps a bus_state structure for each hcd (usb2 and usb3) The structure is picked based on hcd speed, but driver only compared for HCD_USB3 speed, returning the wrong bus_state for HCD_USB31 hosts. This caused null pointer dereference errors in bus_resume function. Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/usb/host/xhci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1509,7 +1509,7 @@ struct xhci_bus_state { static inline unsigned int hcd_index(struct usb_hcd *hcd) { - if (hcd->speed == HCD_USB3) + if (hcd->speed >= HCD_USB3) return 0; else return 1; Patches currently in stable-queue which might be from mathias.nyman@xxxxxxxxxxxxxxx are queue-4.9/xhci-fix-finding-correct-bus_state-structure-for-usb-3.1-hosts.patch queue-4.9/revert-xhci-limit-usb2-port-wake-support-for-amd-promontory-hosts.patch queue-4.9/xhci-set-missing-superspeedplus-link-protocol-bit-in-roothub-descriptor.patch queue-4.9/usb-pci-quirks.c-corrected-timeout-values-used-in-handshake.patch queue-4.9/xhci-fix-sleeping-with-spin_lock_irq-held-in-asmedia-1042a-workaround.patch