Commit 95d1fbab authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200716-pull-request' into staging 



fixes: usb storage regression, vfio display ramfb bug

# gpg: Signature made Thu 16 Jul 2020 10:30:58 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-20200716-pull-request:
  usb: fix storage regression
  vfio: fix use-after-free in display

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 175788d4 4084e350

hw/usb/dev-storage.c

+1 −2
Original line number Diff line number Diff line
@@ -546,8 +546,7 @@ static void usb_msd_handle_data(USBDevice *dev, USBPacket *p) 
                    }

                }

            }

            if (p->actual_length < p->iov.size && (p->short_not_ok ||

                    s->scsi_len >= p->ep->max_packet_size)) {

            if (p->actual_length < p->iov.size && s->mode == USB_MSDM_DATAIN) {

                DPRINTF("Deferring packet %p [wait data-in]\n", p);

                s->packet = p;

                p->status = USB_RET_ASYNC;

hw/vfio/display.c

+1 −0
Original line number Diff line number Diff line
@@ -405,6 +405,7 @@ static void vfio_display_region_update(void *opaque) 
    if (!plane.drm_format || !plane.size) {

        if (dpy->ramfb) {

            ramfb_display_update(dpy->con, dpy->ramfb);

            dpy->region.surface = NULL;

        }

        return;

    }