hcd-musb: fix dereference null return value
usb_ep_get and usb_handle_packet can deal with a NULL device, but we have to avoid dereferencing NULL pointers when building the id. Thanks to Gonglei for an initial stab at fixing this. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
fae38221e7
commit
a9be76576e
|
@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
|
||||||
USBDevice *dev;
|
USBDevice *dev;
|
||||||
USBEndpoint *uep;
|
USBEndpoint *uep;
|
||||||
int idx = epnum && dir;
|
int idx = epnum && dir;
|
||||||
|
int id;
|
||||||
int ttype;
|
int ttype;
|
||||||
|
|
||||||
/* ep->type[0,1] contains:
|
/* ep->type[0,1] contains:
|
||||||
|
@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
|
||||||
/* A wild guess on the FADDR semantics... */
|
/* A wild guess on the FADDR semantics... */
|
||||||
dev = usb_find_device(&s->port, ep->faddr[idx]);
|
dev = usb_find_device(&s->port, ep->faddr[idx]);
|
||||||
uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
|
uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
|
||||||
usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
|
id = pid;
|
||||||
(dev->addr << 16) | (uep->nr << 8) | pid, false, true);
|
if (uep) {
|
||||||
|
id |= (dev->addr << 16) | (uep->nr << 8);
|
||||||
|
}
|
||||||
|
usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);
|
||||||
usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
|
usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
|
||||||
ep->packey[dir].ep = ep;
|
ep->packey[dir].ep = ep;
|
||||||
ep->packey[dir].dir = dir;
|
ep->packey[dir].dir = dir;
|
||||||
|
|
Loading…
Reference in a new issue