falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

xhci: fix segfault 

Guest trying to reset a endpoint of a disconnected device resulted in
xhci trying to dereference uport while being NULL, thereby crashing
qemu.  Fix that by adding a check.  Drop unused dev variable while
touching that code bit.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 75cc1c1fcb)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
This commit is contained in:
Gerd Hoffmann 2013-07-31 10:54:11 +02:00 committed by Michael Roth
parent a3ea885abd
commit 283d8f93e5
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/usb/hcd-xhci.c
View File

@ -1395,7 +1395,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
{ {
XHCISlot *slot; XHCISlot *slot;
XHCIEPContext *epctx; XHCIEPContext *epctx;
USBDevice *dev;
trace_usb_xhci_ep_reset(slotid, epid); trace_usb_xhci_ep_reset(slotid, epid);
assert(slotid >= 1 && slotid <= xhci->numslots); assert(slotid >= 1 && slotid <= xhci->numslots);
@ -1431,8 +1430,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
ep |= 0x80; ep |= 0x80;
} }
dev = xhci->slots[slotid-1].uport->dev; if (!xhci->slots[slotid-1].uport ||
if (!dev) { !xhci->slots[slotid-1].uport->dev) {
return CC_USB_TRANSACTION_ERROR; return CC_USB_TRANSACTION_ERROR;
} }