diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2014-11-17 11:57:23 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2014-11-17 18:02:31 +0100 |
| commit | a9be76576e375a994bbcea0a5eb2a3852969de0e (patch) | |
| tree | bb348d7541b01621b68375a4a84dcac0eb2c966f | |
| parent | fae38221e78fc9f847965f6d18b359b8044df348 (diff) | |
| download | qemu-a9be76576e375a994bbcea0a5eb2a3852969de0e.tar.gz | |
hcd-musb: fix dereference null return value
usb_ep_get and usb_handle_packet can deal with a NULL device, but we have
to avoid dereferencing NULL pointers when building the id.
Thanks to Gonglei for an initial stab at fixing this.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | hw/usb/hcd-musb.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c index 66bc61ae1e..40809f610e 100644 --- a/hw/usb/hcd-musb.c +++ b/hw/usb/hcd-musb.c @@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, USBDevice *dev; USBEndpoint *uep; int idx = epnum && dir; + int id; int ttype; /* ep->type[0,1] contains: @@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, /* A wild guess on the FADDR semantics... */ dev = usb_find_device(&s->port, ep->faddr[idx]); uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf); - usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, - (dev->addr << 16) | (uep->nr << 8) | pid, false, true); + id = pid; + if (uep) { + id |= (dev->addr << 16) | (uep->nr << 8); + } + usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true); usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len); ep->packey[dir].ep = ep; ep->packey[dir].dir = dir; |