Skip to contentSkip to conversation

usb: ehci: fix memory leak in ehci_process_itd

PATCH Applied Li Qiang 3 participants 4 messages Sep 19, 2016 – Sep 29, 2016

lore
Share & tools
lore

Li Qiang

author
#0 lore raw

PATCH 1/1 usb: ehci: fix memory leak in ehci_process_itd

From: Li Qiang <[email protected]>

While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list doesn't be freed thus leading a memory leak issue. This patch avoid this.

Signed-off-by Li Qiang <[email protected]>
---
 hw/usb/hcd-ehci.c | 1 +
 1 file changed, 1 insertion(+)
hw/usb/hcd-ehci.c +1 -0
index b093db7..f4ece9a 100644
@@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci,
             if (off + len > 4096) {
                 /* transfer crosses page border */
                 if (pg == 6) {
+                    qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
                 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
Signature · 1 line
1.8.3.1
author
#1 lore raw

Ping!

2016-09-19 10:48 GMT+08:00 Li Qiang <[email protected]>:

Quoted 28 lines

From: Li Qiang <[email protected]>

While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list doesn't be freed thus leading a memory leak issue. This patch avoid this.

Signed-off-by Li Qiang <[email protected]>
---
 hw/usb/hcd-ehci.c | 1 +
 1 file changed, 1 insertion(+)
hw/usb/hcd-ehci.c +1 -1
index b093db7..f4ece9a 100644
@@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci,
             if (off + len > 4096) {
                 /* transfer crosses page border */
                 if (pg == 6) {
+                    qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
                 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
--

1.8.3.1

Reviewed-by on v1 1/1
#2 lore raw
In reply to Li Qiang
Quoted 5 lines · Li Qiang

From: Li Qiang <[email protected]>

While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list doesn't be freed thus leading a memory

s/doesn't be/is not/

Quoted 13 lines

leak issue. This patch avoid this.

Signed-off-by Li Qiang <[email protected]>
---
 hw/usb/hcd-ehci.c | 1 +
 1 file changed, 1 insertion(+)
hw/usb/hcd-ehci.c +0 -0
index b093db7..f4ece9a 100644

hw/usb/hcd-ehci.c static int ehci_process_itd(EHCIState *ehci, · line 1432

Quoted 7 lines
hw/usb/hcd-ehci.c +1 -0
@@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci,
             if (off + len > 4096) {
                 /* transfer crosses page border */
                 if (pg == 6) {
+                    qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
                 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);

Looks right to me.

Reviewed-by Thomas Huth <[email protected]>