diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2012-10-24 18:13:57 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2012-10-25 09:08:08 +0200 |
| commit | 00a0770de3ddb803a0f81f6aea40b0f945154a68 (patch) | |
| tree | d69254868fc2a0d040c42e01e3ffb50a127bbf00 /hw/usb/hcd-uhci.c | |
| parent | a8170e5e97ad17ca169c64ba87ae2f53850dab4c (diff) | |
| download | qemu-00a0770de3ddb803a0f81f6aea40b0f945154a68.tar.gz | |
uhci: Properly unmap packets on cancel / invalid pid
Packets with an invalid pid, or which were cancelled have
usb_packet_map() called on them on init, but not usb_packet_unmap()
before being freed.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb/hcd-uhci.c')
| -rw-r--r-- | hw/usb/hcd-uhci.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c index c2f08e3735..671c712112 100644 --- a/hw/usb/hcd-uhci.c +++ b/hw/usb/hcd-uhci.c @@ -236,6 +236,7 @@ static void uhci_async_cancel(UHCIAsync *async) trace_usb_uhci_packet_cancel(async->queue->token, async->td, async->done); if (!async->done) usb_cancel_packet(&async->packet); + usb_packet_unmap(&async->packet, &async->sgl); uhci_async_free(async); } @@ -887,6 +888,7 @@ static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, default: /* invalid pid : frame interrupted */ + usb_packet_unmap(&async->packet, &async->sgl); uhci_async_free(async); s->status |= UHCI_STS_HCPERR; uhci_update_irq(s); |