From patchwork Sat Oct 8 08:58:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 9368033 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id ACAA560487 for ; Sat, 8 Oct 2016 08:59:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A111C29993 for ; Sat, 8 Oct 2016 08:59:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9558D29999; Sat, 8 Oct 2016 08:59:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0B1E329993 for ; Sat, 8 Oct 2016 08:59:03 +0000 (UTC) Received: from localhost ([::1]:39974 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bsnTC-0002Ri-63 for patchwork-qemu-devel@patchwork.kernel.org; Sat, 08 Oct 2016 04:59:02 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42939) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bsnSg-0002OX-G4 for qemu-devel@nongnu.org; Sat, 08 Oct 2016 04:58:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bsnSe-0007q3-6u for qemu-devel@nongnu.org; Sat, 08 Oct 2016 04:58:29 -0400 Received: from isrv.corpit.ru ([86.62.121.231]:57724) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bsnSd-0007mE-Vq; Sat, 08 Oct 2016 04:58:28 -0400 Received: from tsrv.tls.msk.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3E0ED40ED7; Sat, 8 Oct 2016 11:58:15 +0300 (MSK) Received: from tls.msk.ru (mjt.vpn.tls.msk.ru [192.168.177.99]) by tsrv.tls.msk.ru (Postfix) with SMTP id 87022B2F; Sat, 8 Oct 2016 11:58:14 +0300 (MSK) Received: (nullmailer pid 19255 invoked by uid 1000); Sat, 08 Oct 2016 08:58:14 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Date: Sat, 8 Oct 2016 11:58:03 +0300 Message-Id: X-Mailer: git-send-email 2.1.4 In-Reply-To: References: In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 86.62.121.231 Subject: [Qemu-devel] [PULL 17/26] usb: ehci: fix memory leak in ehci_process_itd X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-trivial@nongnu.org, Michael Tokarev , Li Qiang Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Li Qiang While processing isochronous transfer descriptors(iTD), if the page select(PG) field value is out of bands it will return. In this situation the ehci's sg list is not freed thus leading to a memory leak issue. This patch avoid this. Signed-off-by: Li Qiang Reviewed-by: Thomas Huth Signed-off-by: Michael Tokarev --- hw/usb/hcd-ehci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index b093db7..f4ece9a 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci, if (off + len > 4096) { /* transfer crosses page border */ if (pg == 6) { + qemu_sglist_destroy(&ehci->isgl); return -1; /* avoid page pg + 1 */ } ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);