Received: from eggs.gnu.org ([2001:4830:134:3::10]:45605) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bloea-0004Cg-BM for qemu-devel@nongnu.org; Sun, 18 Sep 2016 22:49:57 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bloeW-0005e1-9A for qemu-devel@nongnu.org; Sun, 18 Sep 2016 22:49:55 -0400 Received: from mail-wm0-f68.google.com ([74.125.82.68]:32831) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bloeW-0005dJ-2M for qemu-devel@nongnu.org; Sun, 18 Sep 2016 22:49:52 -0400 Received: by mail-wm0-f68.google.com with SMTP id w84so5536146wmg.0 for ; Sun, 18 Sep 2016 19:49:51 -0700 (PDT) Message-ID: <57df5212.87adc20a.7f06f.fda3@mx.google.com> From: Li Qiang Date: Sun, 18 Sep 2016 19:48:35 -0700 Subject: [Qemu-devel] [PATCH] usb: ehci: fix memory leak in ehci_process_itd List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: kraxel@redhat.com, qemu-devel@nongnu.org Cc: Li Qiang From: Li Qiang While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list doesn't be freed thus leading a memory leak issue. This patch avoid this. Signed-off-by: Li Qiang --- hw/usb/hcd-ehci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index b093db7..f4ece9a 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci, if (off + len > 4096) { /* transfer crosses page border */ if (pg == 6) { + qemu_sglist_destroy(&ehci->isgl); return -1; /* avoid page pg + 1 */ } ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); -- 1.8.3.1