[PATCH] usb: xhci: disable the correct slot on alloc_dev failure

[PATCH] usb: xhci: disable the correct slot on alloc_dev failure

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

xhci_alloc_dev() stores the Slot ID returned by the Enable Slot command
in the local slot_id variable.  udev->slot_id is updated only after
xhci_alloc_virt_device() succeeds.

If endpoint resource reservation or virtual device allocation fails
before that update, the error path passes udev->slot_id to
xhci_disable_and_free_slot().  During initial enumeration this is slot 0.
When reallocating a device whose virtual device is missing or belongs to
another usb_device, udev->slot_id may contain a stale Slot ID.
The newly enabled slot can therefore remain active, or the wrong slot can
be disabled.

Pass slot_id, which identifies the slot enabled by this invocation.
xhci_disable_and_free_slot() already handles a missing xhci->devs entry.

Fixes: 3ffbba9511b4 ("USB: xhci: Allocate and address USB devices")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/usb/host/xhci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..dd8c12380e0c 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4298,7 +4298,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
 	return 1;

 disable_slot:
-	xhci_disable_and_free_slot(xhci, udev->slot_id);
+	xhci_disable_and_free_slot(xhci, slot_id);

 	return 0;
 }
--
2.50.1

Re: [PATCH] usb: xhci: disable the correct slot on alloc_dev failure

[Neronin, Niklas]

On 06/08/2026 11.49, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> xhci_alloc_dev() stores the Slot ID returned by the Enable Slot command
> in the local slot_id variable.  udev->slot_id is updated only after
> xhci_alloc_virt_device() succeeds.
> 
> If endpoint resource reservation or virtual device allocation fails
> before that update, the error path passes udev->slot_id to
> xhci_disable_and_free_slot().  During initial enumeration this is slot 0.
> When reallocating a device whose virtual device is missing or belongs to
> another usb_device, udev->slot_id may contain a stale Slot ID.
> The newly enabled slot can therefore remain active, or the wrong slot can
> be disabled.
> 
> Pass slot_id, which identifies the slot enabled by this invocation.
> xhci_disable_and_free_slot() already handles a missing xhci->devs entry.
> 
> Fixes: 3ffbba9511b4 ("USB: xhci: Allocate and address USB devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
>  drivers/usb/host/xhci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
> index 091c82ca8ee2..dd8c12380e0c 100644
> --- a/drivers/usb/host/xhci.c
> +++ b/drivers/usb/host/xhci.c
> @@ -4298,7 +4298,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
>  	return 1;
> 
>  disable_slot:
> -	xhci_disable_and_free_slot(xhci, udev->slot_id);
> +	xhci_disable_and_free_slot(xhci, slot_id);
> 
>  	return 0;
>  }
> --
> 2.50.1

Reviewed-by: Niklas Neronin <niklas.neronin@linux.intel.com>

Thanks,
Niklas