If 'usb_packet_map' fails, we should stop to process the usb
request.
Signed-off-by: Li Qiang
---
hw/usb/hcd-ehci.c | 10 --
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 58cceacbf8..4da446d2de 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1373,7 +1373,10 @@ static int ehci_execute(EHCIPacket *p, const char
*action)
spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
usb_packet_setup(>packet, p->pid, ep, 0, p->qtdaddr, spd,
(p->qtd.token & QTD_TOKEN_IOC) != 0);
-usb_packet_map(>packet, >sgl);
+if (usb_packet_map(>packet, >sgl)) {
+qemu_sglist_destroy(>sgl);
+return -1;
+}
p->async = EHCI_ASYNC_INITIALIZED;
}
@@ -1453,7 +1456,10 @@ static int ehci_process_itd(EHCIState *ehci,
if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
usb_packet_setup(>ipacket, pid, ep, 0, addr, false,
(itd->transact[i] & ITD_XACT_IOC) != 0);
-usb_packet_map(>ipacket, >isgl);
+if (usb_packet_map(>ipacket, >isgl)) {
+qemu_sglist_destroy(>isgl);
+return -1;
+}
usb_handle_packet(dev, >ipacket);
usb_packet_unmap(>ipacket, >isgl);
} else {
--
2.17.1