ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'kraxel/usb.86' into staging 

# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/usb.86:
  usb-redir: fix use-after-free
  xhci: fix segfault

Message-id: 1375362669-14815-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Anthony Liguori 2013-08-05 08:01:25 -05:00
parent b9ac5d923b a14ff8a650
commit d94c426d46
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/usb/hcd-xhci.c
View File

@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
{ {
XHCISlot *slot; XHCISlot *slot;
XHCIEPContext *epctx; XHCIEPContext *epctx;
USBDevice *dev;
trace_usb_xhci_ep_reset(slotid, epid); trace_usb_xhci_ep_reset(slotid, epid);
assert(slotid >= 1 && slotid <= xhci->numslots); assert(slotid >= 1 && slotid <= xhci->numslots);
@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
ep |= 0x80; ep |= 0x80;
} }
dev = xhci->slots[slotid-1].uport->dev; if (!xhci->slots[slotid-1].uport ||
if (!dev) { !xhci->slots[slotid-1].uport->dev) {
return CC_USB_TRANSACTION_ERROR; return CC_USB_TRANSACTION_ERROR;
} }

1
hw/usb/redirect.c
View File

@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
qemu_chr_delete(dev->cs); qemu_chr_delete(dev->cs);
dev->cs = NULL;
/* Note must be done after qemu_chr_close, as that causes a close event */ /* Note must be done after qemu_chr_close, as that causes a close event */
qemu_bh_delete(dev->chardev_close_bh); qemu_bh_delete(dev->chardev_close_bh);