Commit 071608b5 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160229-1' into staging 



usb: redirect bugfix, MAINTAINERS update.

# gpg: Signature made Mon 29 Feb 2016 11:09:54 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20160229-1:
  usb-redirect: Avoid double free of data
  MAINTAINERS: Add some missing entries for USB related files

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 1da90c34 e8ce12d9

MAINTAINERS

+4 −0
Original line number Diff line number Diff line
@@ -857,6 +857,10 @@ M: Gerd Hoffmann <kraxel@redhat.com> 
S: Maintained

F: hw/usb/*

F: tests/usb-*-test.c

F: docs/usb2.txt

F: docs/usb-storage.txt

F: include/hw/usb.h

F: include/hw/usb/



USB (serial adapter)

M: Gerd Hoffmann <kraxel@redhat.com>

hw/usb/redirect.c

+8 −3
Original line number Diff line number Diff line
@@ -447,7 +447,7 @@ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev, 
    return p;

}



static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,

static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,

    uint8_t status, uint8_t ep, void *free_on_destroy)

{

    struct buf_packet *bufp;
@@ -464,7 +464,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, 
        if (dev->endpoint[EP2I(ep)].bufpq_size >

                dev->endpoint[EP2I(ep)].bufpq_target_size) {

            free(data);

            return;

            return -1;

        }

        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;

    }
@@ -477,6 +477,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, 
    bufp->free_on_destroy = free_on_destroy;

    QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);

    dev->endpoint[EP2I(ep)].bufpq_size++;

    return 0;

}



static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
@@ -2082,13 +2083,17 @@ static void usbredir_buffered_bulk_packet(void *priv, uint64_t id, 
    status = usb_redir_success;

    free_on_destroy = NULL;

    for (i = 0; i < data_len; i += len) {

        int r;

        if (len >= (data_len - i)) {

            len = data_len - i;

            status = buffered_bulk_packet->status;

            free_on_destroy = data;

        }

        /* bufp_alloc also adds the packet to the ep queue */

        bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);

        r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);

        if (r) {

            break;

        }

    }



    if (dev->endpoint[EP2I(ep)].pending_async_packet) {