openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge remote-tracking branch 'kraxel/usb.86' into staging 

# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/usb.86:
  usb-redir: fix use-after-free
  xhci: fix segfault

Message-id: 1375362669-14815-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Anthony Liguori 2013-08-05 08:01:25 -05:00
parent b9ac5d923b a14ff8a650
commit d94c426d46
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/usb/hcd-xhci.c
View File

@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
{
XHCISlot *slot;
XHCIEPContext *epctx;
USBDevice *dev;
trace_usb_xhci_ep_reset(slotid, epid);
assert(slotid >= 1 && slotid <= xhci->numslots);
@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
ep |= 0x80;
}
dev = xhci->slots[slotid-1].uport->dev;
if (!dev) {
if (!xhci->slots[slotid-1].uport ||
!xhci->slots[slotid-1].uport->dev) {
return CC_USB_TRANSACTION_ERROR;
}

1
hw/usb/redirect.c
View File

@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
qemu_chr_delete(dev->cs);
dev->cs = NULL;
/* Note must be done after qemu_chr_close, as that causes a close event */
qemu_bh_delete(dev->chardev_close_bh);