Skip to content

Commit

Permalink
xhci: fix segfault
Browse files Browse the repository at this point in the history
Guest trying to reset a endpoint of a disconnected device resulted in
xhci trying to dereference uport while being NULL, thereby crashing
qemu.  Fix that by adding a check.  Drop unused dev variable while
touching that code bit.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  • Loading branch information
kraxel committed Aug 1, 2013
1 parent 75e2a4b commit 75cc1c1
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions hw/usb/hcd-xhci.c
Expand Up @@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
{
XHCISlot *slot;
XHCIEPContext *epctx;
USBDevice *dev;

trace_usb_xhci_ep_reset(slotid, epid);
assert(slotid >= 1 && slotid <= xhci->numslots);
Expand Down Expand Up @@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
ep |= 0x80;
}

dev = xhci->slots[slotid-1].uport->dev;
if (!dev) {
if (!xhci->slots[slotid-1].uport ||
!xhci->slots[slotid-1].uport->dev) {
return CC_USB_TRANSACTION_ERROR;
}

Expand Down

0 comments on commit 75cc1c1

Please sign in to comment.