From d3ac1a87b228bcd231d19acf1ebe9844b7639237 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 2 Sep 2011 13:05:13 +0200 Subject: [PATCH] usb-storage: fix NULL pointer dereference. When a usb packet is canceled we need to check whenever we actually have a scsi request in flight before we try to cancel it. Signed-off-by: Gerd Hoffmann --- hw/usb-msd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/usb-msd.c b/hw/usb-msd.c index e92434cc94..08d2d2ac77 100644 --- a/hw/usb-msd.c +++ b/hw/usb-msd.c @@ -325,7 +325,10 @@ static int usb_msd_handle_control(USBDevice *dev, USBPacket *p, static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p) { MSDState *s = DO_UPCAST(MSDState, dev, dev); - scsi_req_cancel(s->req); + + if (s->req) { + scsi_req_cancel(s->req); + } } static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)