usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

jira LE-2157
cve CVE-2024-42226
Rebuild_History Non-Buildable kernel-5.14.0-503.14.1.el9_5
commit-author Niklas Neronin <[email protected]>
commit 66cb618

Some transfer events don't always point to a TRB, and consequently don't
have a endpoint ring. In these cases, function handle_tx_event() should
not proceed, because if 'ep->skip' is set, the pointer to the endpoint
ring is used.

To prevent a potential failure and make the code logical, return after
checking the completion code for a Transfer event without TRBs.

	Signed-off-by: Niklas Neronin <[email protected]>
	Signed-off-by: Mathias Nyman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit 66cb618)
	Signed-off-by: Jonathan Maple <[email protected]>

Author: PlaidCat

drivers/usb/host/xhci-ring.c

@@ -2660,16 +2660,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 			else
 				xhci_handle_halted_endpoint(xhci, ep, NULL,
 							    EP_SOFT_RESET);
-			goto cleanup;
+			break;
 		case COMP_RING_UNDERRUN:
 		case COMP_RING_OVERRUN:
 		case COMP_STOPPED_LENGTH_INVALID:
-			goto cleanup;
+			break;
 		default:
 			xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
 				 slot_id, ep_index);
 			goto err_out;
 		}
+		return 0;
 	}
 
 	/* Count current td numbers if ep->skip is set */