Commit d94c426d authored by Anthony Liguori's avatar Anthony Liguori
Browse files

Merge remote-tracking branch 'kraxel/usb.86' into staging 



# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/usb.86:
  usb-redir: fix use-after-free
  xhci: fix segfault

Message-id: 1375362669-14815-1-git-send-email-kraxel@redhat.com
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
parents b9ac5d92 a14ff8a6

hw/usb/hcd-xhci.c

+2 −3
Original line number Diff line number Diff line
@@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, 
{

    XHCISlot *slot;

    XHCIEPContext *epctx;

    USBDevice *dev;



    trace_usb_xhci_ep_reset(slotid, epid);

    assert(slotid >= 1 && slotid <= xhci->numslots);
@@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, 
        ep |= 0x80;

    }



    dev = xhci->slots[slotid-1].uport->dev;

    if (!dev) {

    if (!xhci->slots[slotid-1].uport ||

        !xhci->slots[slotid-1].uport->dev) {

        return CC_USB_TRANSACTION_ERROR;

    }

hw/usb/redirect.c

+1 −0
Original line number Diff line number Diff line
@@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev) 
    USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);



    qemu_chr_delete(dev->cs);

    dev->cs = NULL;

    /* Note must be done after qemu_chr_close, as that causes a close event */

    qemu_bh_delete(dev->chardev_close_bh);