[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 12/12] hcd-musb: fix dereference null return value
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 12/12] hcd-musb: fix dereference null return value |
Date: |
Mon, 17 Nov 2014 18:08:19 +0100 |
usb_ep_get and usb_handle_packet can deal with a NULL device, but we have
to avoid dereferencing NULL pointers when building the id.
Thanks to Gonglei for an initial stab at fixing this.
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/usb/hcd-musb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c
index 66bc61a..40809f6 100644
--- a/hw/usb/hcd-musb.c
+++ b/hw/usb/hcd-musb.c
@@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
USBDevice *dev;
USBEndpoint *uep;
int idx = epnum && dir;
+ int id;
int ttype;
/* ep->type[0,1] contains:
@@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
/* A wild guess on the FADDR semantics... */
dev = usb_find_device(&s->port, ep->faddr[idx]);
uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
- usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
- (dev->addr << 16) | (uep->nr << 8) | pid, false, true);
+ id = pid;
+ if (uep) {
+ id |= (dev->addr << 16) | (uep->nr << 8);
+ }
+ usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);
usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
ep->packey[dir].ep = ep;
ep->packey[dir].dir = dir;
--
1.8.3.1
- [Qemu-devel] [PULL 02/12] l2tpv3: fix possible double free, (continued)
- [Qemu-devel] [PULL 02/12] l2tpv3: fix possible double free, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 03/12] l2tpv3: fix fd leak, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 04/12] mips_mipssim: fix use-after-free for filename, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 06/12] loader: fix NEGATIVE_RETURNS, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 05/12] qga: fix false negative argument passing, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 07/12] nvme: remove superfluous check, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 08/12] acl: fix memory leak, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 09/12] qemu-char: fix MISSING_COMMA, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 10/12] shpc: fix error propaagation, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 11/12] target-cris/translate.c: fix out of bounds read, Paolo Bonzini, 2014/11/17
- [Qemu-devel] [PULL 12/12] hcd-musb: fix dereference null return value,
Paolo Bonzini <=
- Re: [Qemu-devel] [PULL 00/12] Coverity fixes for 2.2.0-rc2, Peter Maydell, 2014/11/17