aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2014-11-17 11:57:23 +0100
committerPaolo Bonzini <pbonzini@redhat.com>2014-11-17 18:02:31 +0100
commita9be76576e375a994bbcea0a5eb2a3852969de0e (patch)
treebb348d7541b01621b68375a4a84dcac0eb2c966f /hw
parentfae38221e78fc9f847965f6d18b359b8044df348 (diff)
downloadqemu-a9be76576e375a994bbcea0a5eb2a3852969de0e.zip
qemu-a9be76576e375a994bbcea0a5eb2a3852969de0e.tar.gz
qemu-a9be76576e375a994bbcea0a5eb2a3852969de0e.tar.bz2
hcd-musb: fix dereference null return value
usb_ep_get and usb_handle_packet can deal with a NULL device, but we have to avoid dereferencing NULL pointers when building the id. Thanks to Gonglei for an initial stab at fixing this. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/usb/hcd-musb.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c
index 66bc61a..40809f6 100644
--- a/hw/usb/hcd-musb.c
+++ b/hw/usb/hcd-musb.c
@@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
USBDevice *dev;
USBEndpoint *uep;
int idx = epnum && dir;
+ int id;
int ttype;
/* ep->type[0,1] contains:
@@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
/* A wild guess on the FADDR semantics... */
dev = usb_find_device(&s->port, ep->faddr[idx]);
uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
- usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
- (dev->addr << 16) | (uep->nr << 8) | pid, false, true);
+ id = pid;
+ if (uep) {
+ id |= (dev->addr << 16) | (uep->nr << 8);
+ }
+ usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);
usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
ep->packey[dir].ep = ep;
ep->packey[dir].dir = dir;