From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:60900)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lvivier@redhat.com>) id 1aVdIq-0002Fa-GG
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 05:56:21 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <lvivier@redhat.com>) id 1aVdIn-0002gs-Am
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 05:56:20 -0500
Received: from mx1.redhat.com ([209.132.183.28]:56340)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lvivier@redhat.com>) id 1aVdIn-0002gL-5E
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 05:56:17 -0500
References: <1455617054-8481-1-git-send-email-ppandit@redhat.com>
From: Laurent Vivier <lvivier@redhat.com>
Message-ID: <56C3004D.1010008@redhat.com>
Date: Tue, 16 Feb 2016 11:56:13 +0100
MIME-Version: 1.0
In-Reply-To: <1455617054-8481-1-git-send-email-ppandit@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] usb: ohci avoid multiple eof timers
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: P J P <ppandit@redhat.com>, Qemu Developers <qemu-devel@nongnu.org>
Cc: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>, Gerd Hoffmann <kraxel@redhat.com>, Prasad J Pandit <pjp@fedoraproject.org>



On 16/02/2016 11:04, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> When transitioning an OHCI controller to the OHCI_USB_OPERATIONAL
> state, it creates an eof timer object in 'ohci_bus_start'.
> It does not check if one already exists. This results in memory
> leakage and null dereference issue. Add a check to avoid it.
> 
> Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Reviewed-by: Laurent Vivier <lvivier@redhat.com>

> ---
>  hw/usb/hcd-ohci.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
> index 7d65818..15f0b44 100644
> --- a/hw/usb/hcd-ohci.c
> +++ b/hw/usb/hcd-ohci.c
> @@ -1331,11 +1331,11 @@ static void ohci_frame_boundary(void *opaque)
>   */
>  static int ohci_bus_start(OHCIState *ohci)
>  {
> -    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
> -                    ohci_frame_boundary,
> -                    ohci);
> -
> -    if (ohci->eof_timer == NULL) {
> +    if (!ohci->eof_timer) {
> +        ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
> +                                        ohci_frame_boundary, ohci);
> +    }
> +    if (!ohci->eof_timer) {
>          trace_usb_ohci_bus_eof_timer_failed(ohci->name);
>          ohci_die(ohci);
>          return 0;
>