[PATCH v2 4/4] xhci-ring.c: Fix crash when issuing "usb reset"

[Jason Wessel]

When TRB_TRANSFER is set for a call to xhci_wait_for_event, it can
return null, which causes u-boot to crash.  This is an intermittent
problem found during "usb reset" testing.

If the null return occurs it means there was a timeout, and the
abort_td() should return immediately vs crashing u-boot from a null
dereference.

Signed-off-by: Jason Wessel <jason.wessel at windriver.com>
---
 drivers/usb/host/xhci-ring.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 00a0491771..bbb4410908 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -499,11 +499,16 @@ static void abort_td(struct usb_device *udev, int ep_index)
 	xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING);
 
 	event = xhci_wait_for_event(ctrl, TRB_TRANSFER, false);
-	field = le32_to_cpu(event->trans_event.flags);
-	BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id);
-	BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
-	BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len
-		!= COMP_STOP)));
+	if (event) {
+		field = le32_to_cpu(event->trans_event.flags);
+		BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id);
+		BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
+		BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len
+						 != COMP_STOP)));
+	} else {
+		debug("XHCI abort timeout\n");
+		return;
+	}
 	xhci_acknowledge_event(ctrl);
 
 	event = xhci_wait_for_event(ctrl, TRB_COMPLETION, false);
-- 
2.17.1