From 75cc1c1fcba1987bdf3979c4289ab756c2b15742 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 31 Jul 2013 10:54:11 +0200 Subject: xhci: fix segfault Guest trying to reset a endpoint of a disconnected device resulted in xhci trying to dereference uport while being NULL, thereby crashing qemu. Fix that by adding a check. Drop unused dev variable while touching that code bit. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-xhci.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 7cbf813696..ff5f68135c 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -1429,7 +1429,6 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, { XHCISlot *slot; XHCIEPContext *epctx; - USBDevice *dev; trace_usb_xhci_ep_reset(slotid, epid); assert(slotid >= 1 && slotid <= xhci->numslots); @@ -1465,8 +1464,8 @@ static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, ep |= 0x80; } - dev = xhci->slots[slotid-1].uport->dev; - if (!dev) { + if (!xhci->slots[slotid-1].uport || + !xhci->slots[slotid-1].uport->dev) { return CC_USB_TRANSACTION_ERROR; } -- cgit v1.2.3 From a14ff8a650b5943ee6221b952494661f7cb3b5e2 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 31 Jul 2013 11:17:58 +0200 Subject: usb-redir: fix use-after-free Reinitialize dev->cs to NULL after deleting it, to make sure it isn't used afterwards. Reported-by: Martin Cerveny Signed-off-by: Gerd Hoffmann --- hw/usb/redirect.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c index 8b8c010d94..e3b9f324b3 100644 --- a/hw/usb/redirect.c +++ b/hw/usb/redirect.c @@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev) USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); qemu_chr_delete(dev->cs); + dev->cs = NULL; /* Note must be done after qemu_chr_close, as that causes a close event */ qemu_bh_delete(dev->chardev_close_bh); -- cgit v1.2.3