From: Prasad J Pandit <p...@fedoraproject.org>
When transitioning an OHCI controller to the OHCI_USB_OPERATIONAL
state, it creates an eof timer object in 'ohci_bus_start'.
It does not check if one already exists. This results in memory
leakage and null dereference issue. Add a check to avoid it.
Reported-by: Zuozhi Fzz <zuozhi....@alibaba-inc.com>
Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
---
hw/usb/hcd-ohci.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index 7d65818..15f0b44 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1331,11 +1331,11 @@ static void ohci_frame_boundary(void *opaque)
*/
static int ohci_bus_start(OHCIState *ohci)
{
- ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
- ohci_frame_boundary,
- ohci);
-
- if (ohci->eof_timer == NULL) {
+ if (!ohci->eof_timer) {
+ ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+ ohci_frame_boundary, ohci);
+ }
+ if (!ohci->eof_timer) {
trace_usb_ohci_bus_eof_timer_failed(ohci->name);
ohci_die(ohci);
return 0;
--
2.5.0
