From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:53199)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XqKKi-0003oV-4B
	for qemu-devel@nongnu.org; Mon, 17 Nov 2014 06:19:05 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XqKKd-0005bh-Ak
	for qemu-devel@nongnu.org; Mon, 17 Nov 2014 06:19:00 -0500
Message-ID: <5469D98A.8020408@huawei.com>
Date: Mon, 17 Nov 2014 19:18:34 +0800
From: Gonglei <arei.gonglei@huawei.com>
MIME-Version: 1.0
References: <1416046008-7880-1-git-send-email-arei.gonglei@huawei.com>
	<1416046008-7880-10-git-send-email-arei.gonglei@huawei.com>
	<5469D4C4.5090407@redhat.com>
In-Reply-To: <5469D4C4.5090407@redhat.com>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 9/9] hcd-musb: fix dereference null return
	value
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Huangweidong (C)" <weidong.huang@huawei.com>, Zhanghailiang <zhang.zhanghailiang@huawei.com>, "qemu-trivial@nongnu.org" <qemu-trivial@nongnu.org>, "mjt@tls.msk.ru" <mjt@tls.msk.ru>, "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, "Huangpeng (Peter)" <peter.huangpeng@huawei.com>, Gerd Hoffmann <kraxel@redhat.com>

On 2014/11/17 18:58, Paolo Bonzini wrote:

> 
> 
> On 15/11/2014 11:06, arei.gonglei@huawei.com wrote:
>> From: Gonglei <arei.gonglei@huawei.com>
>>
>> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
>> ---
>>  hw/usb/hcd-musb.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c
>> index 66bc61a..f2cb73c 100644
>> --- a/hw/usb/hcd-musb.c
>> +++ b/hw/usb/hcd-musb.c
>> @@ -624,6 +624,10 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
>>  
>>      /* A wild guess on the FADDR semantics... */
>>      dev = usb_find_device(&s->port, ep->faddr[idx]);
>> +    if (!dev) {
>> +        TRACE("Do not find an usb device");
>> +        return;
>> +    }
>>      uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
>>      usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
>>                       (dev->addr << 16) | (uep->nr << 8) | pid, false, true);
>>
> 
> I think this patch is not the real fix.  usb_ep_get and
> usb_handle_packet can deal with a NULL device, but we have to avoid 
> dereferencing NULL pointers when building the id.
> 

Good catch :)

> Paolo
> 
> diff --git a/hw/usb/hcd-musb.c b/hw/usb/hcd-musb.c
> index 66bc61a..40809f6 100644
> --- a/hw/usb/hcd-musb.c
> +++ b/hw/usb/hcd-musb.c
> @@ -608,6 +608,7 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
>      USBDevice *dev;
>      USBEndpoint *uep;
>      int idx = epnum && dir;
> +    int id;
>      int ttype;
>  
>      /* ep->type[0,1] contains:
> @@ -625,8 +626,11 @@ static void musb_packet(MUSBState *s, MUSBEndPoint *ep,
>      /* A wild guess on the FADDR semantics... */
>      dev = usb_find_device(&s->port, ep->faddr[idx]);
>      uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf);
> -    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0,
> -                     (dev->addr << 16) | (uep->nr << 8) | pid, false, true);
> +    id = pid;
> +    if (uep) {
> +        id |= (dev->addr << 16) | (uep->nr << 8);
> +    }
> +    usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true);
>      usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len);
>      ep->packey[dir].ep = ep;
>      ep->packey[dir].dir = dir;

This is a good approach, id is just a identifying. Thanks,

Best regards,
-Gonglei