mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: redirect bugfix, MAINTAINERS update.

Browse Source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJW1CcCAAoJEEy22O7T6HE47tQQAIbvlJvX2x208k9BeKejRItz
 QFwyqTR/HM8ISCUvUijDwlD2ZQWKQkg+gOcUElHHZF5IfmH6fVI7Gl3/PSiHAJTv
 jISVwocVk7byTzdxpRWIeDshQ/6WwaSH9vNaI90jTjfkq0zleKwqWJIUxyG198X1
 D4OZhBYVu5V3pZwpkY0faXAIlbGnNd+D0klMdUfJFv8RZr00Axb9Q8oRm5ftSFSF
 Z2/muIGfltkqg5KZX+tOKVUEV+WK3XfxVCVfK8Oq5yPaK6HA2P8eiqynTQ9j7I2r
 ATbr4YFLdbj0lgJEu7ypI1CkUACTTJ2k1rpe0lHmLXezyVqlutSV0wU16/kekrvn
 uuPXoyB1n5KqSh2zXmeQHNV3kgFzqhuqmbJI6HeUCcrlHkXBJe/4tdeuomB2tqqh
 7Q1igD10o5E/kTFiTWheowLrdOQsDzPCDlQveqJHfzZpJktDG5r1E3DqTKkFnTlv
 gMwcLPWIb1TvtBVbtnYZGavGgGmjuLLhSebl7cM2xKbOkdVo/7ZkyeCgPBiVMp+U
 rT+GZI8hIuZIlcjejw7iJ05kuj1y9BMbFpNEKrNYPCvmBmonkxvoKnK+cQamvN+R
 yAEdtSZV3mFhNMjC9k1EnBza4aH/5tZ4zNQ1dFLPJ8r/Bl/NOE4Tsesm0Tley3TK
 cSds5BddGaieJXUJisV3
 =c06t
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160229-1' into staging

usb: redirect bugfix, MAINTAINERS update.

# gpg: Signature made Mon 29 Feb 2016 11:09:54 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20160229-1:
  usb-redirect: Avoid double free of data
  MAINTAINERS: Add some missing entries for USB related files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2016-02-29 12:24:26 +00:00
commit 071608b519
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
MAINTAINERS
View File

@ -857,6 +857,10 @@ M: Gerd Hoffmann <kraxel@redhat.com>
S: Maintained S: Maintained
F: hw/usb/* F: hw/usb/*
F: tests/usb-*-test.c F: tests/usb-*-test.c
F: docs/usb2.txt
F: docs/usb-storage.txt
F: include/hw/usb.h
F: include/hw/usb/
USB (serial adapter) USB (serial adapter)
M: Gerd Hoffmann <kraxel@redhat.com> M: Gerd Hoffmann <kraxel@redhat.com>

11
hw/usb/redirect.c
View File

@ -447,7 +447,7 @@ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
return p; return p;
} }
static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
uint8_t status, uint8_t ep, void *free_on_destroy) uint8_t status, uint8_t ep, void *free_on_destroy)
{ {
struct buf_packet *bufp; struct buf_packet *bufp;
@ -464,7 +464,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
if (dev->endpoint[EP2I(ep)].bufpq_size > if (dev->endpoint[EP2I(ep)].bufpq_size >
dev->endpoint[EP2I(ep)].bufpq_target_size) { dev->endpoint[EP2I(ep)].bufpq_target_size) {
free(data); free(data);
return; return -1;
} }
dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
} }
@ -477,6 +477,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
bufp->free_on_destroy = free_on_destroy; bufp->free_on_destroy = free_on_destroy;
QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
dev->endpoint[EP2I(ep)].bufpq_size++; dev->endpoint[EP2I(ep)].bufpq_size++;
return 0;
} }
static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp, static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
@ -2082,13 +2083,17 @@ static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
status = usb_redir_success; status = usb_redir_success;
free_on_destroy = NULL; free_on_destroy = NULL;
for (i = 0; i < data_len; i += len) { for (i = 0; i < data_len; i += len) {
int r;
if (len >= (data_len - i)) { if (len >= (data_len - i)) {
len = data_len - i; len = data_len - i;
status = buffered_bulk_packet->status; status = buffered_bulk_packet->status;
free_on_destroy = data; free_on_destroy = data;
} }
/* bufp_alloc also adds the packet to the ep queue */ /* bufp_alloc also adds the packet to the ep queue */
bufp_alloc(dev, data + i, len, status, ep, free_on_destroy); r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
if (r) {
break;
}
} }
if (dev->endpoint[EP2I(ep)].pending_async_packet) { if (dev->endpoint[EP2I(ep)].pending_async_packet) {