[Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Hani Benhabiles]

Due to an incomplete initialization, adding a usb-bt-dongle device through HMP
or QMP will cause a segmentation fault.

Signed-off-by: Hani Benhabiles <hani@linux.com>
---

Not sure about the exact policy of qemu-stable. CC'ing it as this bug results in
a segfault.

 hw/usb/dev-bluetooth.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index a9661d2..6d02343 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -506,6 +506,12 @@ static int usb_bt_initfn(USBDevice *dev)
 
     usb_desc_create_serial(dev);
     usb_desc_init(dev);
+    s->dev.opaque = s;
+    s->hci = bt_new_hci(qemu_find_bt_vlan(0));
+    s->hci->opaque = s;
+    s->hci->evt_recv = usb_bt_out_hci_packet_event;
+    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
+    usb_bt_handle_reset(&s->dev);
     s->intr = usb_ep_get(dev, USB_TOKEN_IN, USB_EVT_EP);
 
     return 0;
-- 
1.8.3.2

Re: [Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Paolo Bonzini]

Il 11/06/2014 19:25, Hani Benhabiles ha scritto:
> Due to an incomplete initialization, adding a usb-bt-dongle device through HMP
> or QMP will cause a segmentation fault.
>
> Signed-off-by: Hani Benhabiles <hani@linux.com>
> ---
>
> Not sure about the exact policy of qemu-stable. CC'ing it as this bug results in
> a segfault.
>
>  hw/usb/dev-bluetooth.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
> index a9661d2..6d02343 100644
> --- a/hw/usb/dev-bluetooth.c
> +++ b/hw/usb/dev-bluetooth.c
> @@ -506,6 +506,12 @@ static int usb_bt_initfn(USBDevice *dev)
>
>      usb_desc_create_serial(dev);
>      usb_desc_init(dev);
> +    s->dev.opaque = s;
> +    s->hci = bt_new_hci(qemu_find_bt_vlan(0));
> +    s->hci->opaque = s;
> +    s->hci->evt_recv = usb_bt_out_hci_packet_event;
> +    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
> +    usb_bt_handle_reset(&s->dev);


All lines but the s->hci assignment should be removed from usb_bt_init too.

As to s->hci, I suggest inlining usb_create_simple into usb_bt_init, and 
initializing s->hci there before doing the qdev_init() call.

Then here you can wrap the assignment under "if (!s->hci)".

Thanks for TLC of this little-used piece of code.

Paolo

>      s->intr = usb_ep_get(dev, USB_TOKEN_IN, USB_EVT_EP);
>
>      return 0;
>

Re: [Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Hani Benhabiles]

On Wed, Jun 11, 2014 at 08:58:08PM +0200, Paolo Bonzini wrote:
> Il 11/06/2014 19:25, Hani Benhabiles ha scritto:
> >Due to an incomplete initialization, adding a usb-bt-dongle device through HMP
> >or QMP will cause a segmentation fault.
> >
> >Signed-off-by: Hani Benhabiles <hani@linux.com>
> >---
> >
> >Not sure about the exact policy of qemu-stable. CC'ing it as this bug results in
> >a segfault.
> >
> > hw/usb/dev-bluetooth.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> >diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
> >index a9661d2..6d02343 100644
> >--- a/hw/usb/dev-bluetooth.c
> >+++ b/hw/usb/dev-bluetooth.c
> >@@ -506,6 +506,12 @@ static int usb_bt_initfn(USBDevice *dev)
> >
> >     usb_desc_create_serial(dev);
> >     usb_desc_init(dev);
> >+    s->dev.opaque = s;
> >+    s->hci = bt_new_hci(qemu_find_bt_vlan(0));
> >+    s->hci->opaque = s;
> >+    s->hci->evt_recv = usb_bt_out_hci_packet_event;
> >+    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
> >+    usb_bt_handle_reset(&s->dev);
> 
> 
> All lines but the s->hci assignment should be removed from usb_bt_init too.
> 
> As to s->hci, I suggest inlining usb_create_simple into usb_bt_init, and
> initializing s->hci there before doing the qdev_init() call.
> 
> Then here you can wrap the assignment under "if (!s->hci)".

I am afraid I don't quite understand what you want to achieve with this and why.

Could you please explain how is usb_bt_init() relevant to this case ?

Thanks

> 
> Thanks for TLC of this little-used piece of code.
> 
> Paolo
> 
> >     s->intr = usb_ep_get(dev, USB_TOKEN_IN, USB_EVT_EP);
> >
> >     return 0;
> >
> 

Re: [Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Paolo Bonzini]

Il 15/06/2014 23:37, Hani Benhabiles ha scritto:
>>> diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
>>> index a9661d2..6d02343 100644
>>> --- a/hw/usb/dev-bluetooth.c
>>> +++ b/hw/usb/dev-bluetooth.c
>>> @@ -506,6 +506,12 @@ static int usb_bt_initfn(USBDevice *dev)
>>>
>>>     usb_desc_create_serial(dev);
>>>     usb_desc_init(dev);
>>> +    s->dev.opaque = s;
>>> +    s->hci = bt_new_hci(qemu_find_bt_vlan(0));
>>> +    s->hci->opaque = s;
>>> +    s->hci->evt_recv = usb_bt_out_hci_packet_event;
>>> +    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
>>> +    usb_bt_handle_reset(&s->dev);
>>
>>
>> All lines but the s->hci assignment should be removed from usb_bt_init too.
>>
>> As to s->hci, I suggest inlining usb_create_simple into usb_bt_init, and
>> initializing s->hci there before doing the qdev_init() call.
>>
>> Then here you can wrap the assignment under "if (!s->hci)".
>
> I am afraid I don't quite understand what you want to achieve with this and why.
>
> Could you please explain how is usb_bt_init() relevant to this case ?

usb_bt_init() ends up calling usb_bt_initfn(), via usb_create_simple. 
So if you add code to usb_bt_initfn() you can remove the corresponding 
lines in usb_bt_init().

Paolo

Re: [Qemu-devel] [PATCH] usb: Fix usb-bt-dongle segfault.

[Hani Benhabiles]

On Mon, Jun 16, 2014 at 11:00:42AM +0200, Paolo Bonzini wrote:
> Il 15/06/2014 23:37, Hani Benhabiles ha scritto:
> >>>diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
> >>>index a9661d2..6d02343 100644
> >>>--- a/hw/usb/dev-bluetooth.c
> >>>+++ b/hw/usb/dev-bluetooth.c
> >>>@@ -506,6 +506,12 @@ static int usb_bt_initfn(USBDevice *dev)
> >>>
> >>>    usb_desc_create_serial(dev);
> >>>    usb_desc_init(dev);
> >>>+    s->dev.opaque = s;
> >>>+    s->hci = bt_new_hci(qemu_find_bt_vlan(0));
> >>>+    s->hci->opaque = s;
> >>>+    s->hci->evt_recv = usb_bt_out_hci_packet_event;
> >>>+    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
> >>>+    usb_bt_handle_reset(&s->dev);
> >>
> >>
> >>All lines but the s->hci assignment should be removed from usb_bt_init too.
> >>
> >>As to s->hci, I suggest inlining usb_create_simple into usb_bt_init, and
> >>initializing s->hci there before doing the qdev_init() call.
> >>
> >>Then here you can wrap the assignment under "if (!s->hci)".
> >
> >I am afraid I don't quite understand what you want to achieve with this and why.
> >
> >Could you please explain how is usb_bt_init() relevant to this case ?
> 
> usb_bt_init() ends up calling usb_bt_initfn(), via usb_create_simple. So if
> you add code to usb_bt_initfn() you can remove the corresponding lines in
> usb_bt_init().

Thanks for the clarification. I forgot about -usbdevice bt, will send v2 shortly.