[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] usb: ohci avoid multiple eof timers
From: |
Laurent Vivier |
Subject: |
Re: [Qemu-devel] [PATCH] usb: ohci avoid multiple eof timers |
Date: |
Tue, 16 Feb 2016 11:56:13 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 |
On 16/02/2016 11:04, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> When transitioning an OHCI controller to the OHCI_USB_OPERATIONAL
> state, it creates an eof timer object in 'ohci_bus_start'.
> It does not check if one already exists. This results in memory
> leakage and null dereference issue. Add a check to avoid it.
>
> Reported-by: Zuozhi Fzz <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
Reviewed-by: Laurent Vivier <address@hidden>
> ---
> hw/usb/hcd-ohci.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
> index 7d65818..15f0b44 100644
> --- a/hw/usb/hcd-ohci.c
> +++ b/hw/usb/hcd-ohci.c
> @@ -1331,11 +1331,11 @@ static void ohci_frame_boundary(void *opaque)
> */
> static int ohci_bus_start(OHCIState *ohci)
> {
> - ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
> - ohci_frame_boundary,
> - ohci);
> -
> - if (ohci->eof_timer == NULL) {
> + if (!ohci->eof_timer) {
> + ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
> + ohci_frame_boundary, ohci);
> + }
> + if (!ohci->eof_timer) {
> trace_usb_ohci_bus_eof_timer_failed(ohci->name);
> ohci_die(ohci);
> return 0;
>