[Qemu-devel] [PATCH] hcd-musb: fix dereference null return value

[arei.gonglei]

From: Gonglei <address@hidden>

usb_ep_get and usb_handle_packet can deal with
a NULL device, but we have to avoid dereferencing
NULL pointers when building the id.

Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Gonglei <address@hidden>
---
 hw/usb/hcd-musb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c
index 66bc61a..72ddc7e 100644
--- a/hw/usb/hcd-musb.c
+++ b/hw/usb/hcd-musb.c
@@ -609,6 +609,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
     USBEndpoint *uep;
     int idx = epnum && dir;
     int ttype;
+    uint64_t id;
 
     /* ep->type[0,1] contains:
      * in bits 7:6 the speed (0 - invalid, 1 - high, 2 - full, 3 - slow)
@@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
     /* A wild guess on the FADDR semantics... */
     dev = usb_find_device(&s->port, ep->faddr[idx]);
     uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
-    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
-                     (dev->addr << 16) | (uep->nr << 8) | pid, false, true);
+    id = (uint64_t)pid;
+    if (uep) {
+        id |= (dev->addr << 16) | (uep->nr << 8);
+    }
+    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);
     usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
     ep->packey[dir].ep = ep;
     ep->packey[dir].dir = dir;
-- 
1.7.12.4