From a9be76576e375a994bbcea0a5eb2a3852969de0e Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Mon, 17 Nov 2014 11:57:23 +0100 Subject: hcd-musb: fix dereference null return value usb_ep_get and usb_handle_packet can deal with a NULL device, but we have to avoid dereferencing NULL pointers when building the id. Thanks to Gonglei for an initial stab at fixing this. Signed-off-by: Paolo Bonzini --- hw/usb/hcd-musb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'hw/usb') diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c index 66bc61ae1e..40809f610e 100644 --- a/hw/usb/hcd-musb.c +++ b/hw/usb/hcd-musb.c @@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, USBDevice *dev; USBEndpoint *uep; int idx = epnum && dir; + int id; int ttype; /* ep->type[0,1] contains: @@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep, /* A wild guess on the FADDR semantics... */ dev = usb_find_device(&s->port, ep->faddr[idx]); uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf); - usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, - (dev->addr << 16) | (uep->nr << 8) | pid, false, true); + id = pid; + if (uep) { + id |= (dev->addr << 16) | (uep->nr << 8); + } + usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true); usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len); ep->packey[dir].ep = ep; ep->packey[dir].dir = dir; -- cgit v1.2.3