diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2012-11-14 16:21:36 +0000 |
|---|---|---|
| committer | Hans de Goede <hdegoede@redhat.com> | 2013-04-03 11:00:50 +0200 |
| commit | 9c8576aeca2d65e17748dc137f0e9abeb2959604 (patch) | |
| tree | 520ac821dd5d6a736bbb3ab101a09c3b005586dc | |
| parent | e664758ee11759da7030a81d977a9ec7e22e7cc0 (diff) | |
ehci: Don't access packet after freeing it
ehci_state_writeback() will free the packet, so we should not access
the packet after calling ehci_state_writeback().
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from 30d68cf6e156b97fc462e18f38ce83f44702cd7f)
| -rw-r--r-- | hw/usb/hcd-ehci.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 46f6d995e..4229061e6 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -752,12 +752,13 @@ static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) static void ehci_free_packet(EHCIPacket *p) { if (p->async == EHCI_ASYNC_FINISHED) { - int state = ehci_get_state(p->queue->ehci, p->queue->async); + EHCIQueue *q = p->queue; + int state = ehci_get_state(q->ehci, q->async); /* This is a normal, but rare condition (cancel racing completion) */ fprintf(stderr, "EHCI: Warning packet completed but not processed\n"); - ehci_state_executing(p->queue); - ehci_state_writeback(p->queue); - ehci_set_state(p->queue->ehci, p->queue->async, state); + ehci_state_executing(q); + ehci_state_writeback(q); + ehci_set_state(q->ehci, q->async, state); /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */ return; } |