From 2f044f2aa772a937e22c54b452152fdc8e2d1cff Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Fri, 19 Jul 2019 21:04:25 -0400
Subject: [PATCH] XHCI: Check return status of PrepareKernelAccess.

Potentially fixes #15172.
---
 src/add-ons/kernel/busses/usb/xhci.cpp | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/add-ons/kernel/busses/usb/xhci.cpp b/src/add-ons/kernel/busses/usb/xhci.cpp
index 00e47813fa..d9c21b6ce7 100644
--- a/src/add-ons/kernel/busses/usb/xhci.cpp
+++ b/src/add-ons/kernel/busses/usb/xhci.cpp
@@ -848,7 +848,11 @@ XHCI::SubmitNormalRequest(Transfer *transfer)
 
 	if (!directionIn) {
 		TRACE("copying out iov count %ld\n", transfer->VectorCount());
-		transfer->PrepareKernelAccess();
+		status_t status = transfer->PrepareKernelAccess();
+		if (status != B_OK) {
+			FreeDescriptor(td);
+			return status;
+		}
 		WriteDescriptor(td, transfer->Vector(), transfer->VectorCount());
 	}
 
@@ -2801,9 +2805,13 @@ XHCI::FinishTransfers()
 			if (callbackStatus == B_OK) {
 				if (directionIn && actualLength > 0) {
 					TRACE("copying in iov count %ld\n", transfer->VectorCount());
-					transfer->PrepareKernelAccess();
-					ReadDescriptor(td, transfer->Vector(),
-						transfer->VectorCount());
+					status_t status = transfer->PrepareKernelAccess();
+					if (status == B_OK) {
+						ReadDescriptor(td, transfer->Vector(),
+							transfer->VectorCount());
+					} else {
+						callbackStatus = status;
+					}
 				}
 			}
 			transfer->Finished(callbackStatus, actualLength);