Patchwork [01/36] uhci: Properly unmap packets on cancel / invalid pid

login
register
mail settings
Submitter Gerd Hoffmann
Date Oct. 25, 2012, 12:51 p.m.
Message ID <1351169529-10799-2-git-send-email-kraxel@redhat.com>
Download mbox | patch
Permalink /patch/194228/
State New
Headers show

Comments

Gerd Hoffmann - Oct. 25, 2012, 12:51 p.m.
From: Hans de Goede <hdegoede@redhat.com>

Packets with an invalid pid, or which were cancelled have
usb_packet_map() called on them on init, but not usb_packet_unmap()
before being freed.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-uhci.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

Patch

diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index c2f08e3..671c712 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -236,6 +236,7 @@  static void uhci_async_cancel(UHCIAsync *async)
     trace_usb_uhci_packet_cancel(async->queue->token, async->td, async->done);
     if (!async->done)
         usb_cancel_packet(&async->packet);
+    usb_packet_unmap(&async->packet, &async->sgl);
     uhci_async_free(async);
 }
 
@@ -887,6 +888,7 @@  static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td,
 
     default:
         /* invalid pid : frame interrupted */
+        usb_packet_unmap(&async->packet, &async->sgl);
         uhci_async_free(async);
         s->status |= UHCI_STS_HCPERR;
         uhci_update_irq(s);