usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

JIRA: https://issues.redhat.com/browse/RHEL-52378
CVE: CVE-2024-42226

commit 66cb618
Author: Niklas Neronin <niklas.neronin@linux.intel.com>
Date: Mon, 29 Apr 2024 17:02:37 +0300

  Some transfer events don't always point to a TRB, and consequently don't
  have a endpoint ring. In these cases, function handle_tx_event() should
  not proceed, because if 'ep->skip' is set, the pointer to the endpoint
  ring is used.

  To prevent a potential failure and make the code logical, return after
  checking the completion code for a Transfer event without TRBs.

  Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
  Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
  Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com
  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Desnes Nunes <desnesn@redhat.com>

Author: Desnes Nunes

drivers/usb/host/xhci-ring.c

@@ -2660,16 +2660,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 			else
 				xhci_handle_halted_endpoint(xhci, ep, NULL,
 							    EP_SOFT_RESET);
-			goto cleanup;
+			break;
 		case COMP_RING_UNDERRUN:
 		case COMP_RING_OVERRUN:
 		case COMP_STOPPED_LENGTH_INVALID:
-			goto cleanup;
+			break;
 		default:
 			xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
 				 slot_id, ep_index);
 			goto err_out;
 		}
+		return 0;
 	}
 
 	/* Count current td numbers if ep->skip is set */