Commit 75cc1c1f authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

xhci: fix segfault 



Guest trying to reset a endpoint of a disconnected device resulted in
xhci trying to dereference uport while being NULL, thereby crashing
qemu.  Fix that by adding a check.  Drop unused dev variable while
touching that code bit.

Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 75e2a4ba

hw/usb/hcd-xhci.c

+2 −3
Original line number Diff line number Diff line
@@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, 
{

    XHCISlot *slot;

    XHCIEPContext *epctx;

    USBDevice *dev;



    trace_usb_xhci_ep_reset(slotid, epid);

    assert(slotid >= 1 && slotid <= xhci->numslots);
@@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, 
        ep |= 0x80;

    }



    dev = xhci->slots[slotid-1].uport->dev;

    if (!dev) {

    if (!xhci->slots[slotid-1].uport ||

        !xhci->slots[slotid-1].uport->dev) {

        return CC_USB_TRANSACTION_ERROR;

    }