From 1f17d0f4acbb488f8ba63f43ccd5853c47000ad5 Mon Sep 17 00:00:00 2001 From: Yonghua Huang Date: Thu, 1 Jul 2021 16:14:46 +0800 Subject: [PATCH] DM: xHCI: Check trb pointer before use it The trb pointer may be NULL when get the address from user space, add the pointer check before use the trb. Tracked-On: #6172 Signed-off-by: Liu Long Reviewed-by: Shuo A Liu Acked-by: Yu Wang --- devicemodel/hw/pci/xhci.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/devicemodel/hw/pci/xhci.c b/devicemodel/hw/pci/xhci.c index 80b3d7576..b230977db 100644 --- a/devicemodel/hw/pci/xhci.c +++ b/devicemodel/hw/pci/xhci.c @@ -2552,6 +2552,10 @@ pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) trb = xdev->opregs.cr_p; ccs = xdev->opregs.crcr & XHCI_CRCR_LO_RCS; crcr = xdev->opregs.crcr & ~0xF; + if (!trb) { + UPRINTF(LDBG, "Get the invalid guest address!\r\n"); + goto out; + } while (1) { xdev->opregs.cr_p = trb; @@ -2677,6 +2681,7 @@ pci_xhci_complete_commands(struct pci_xhci_vdev *xdev) trb = pci_xhci_trb_next(xdev, trb, &crcr); } +out: xdev->opregs.crcr = crcr | (xdev->opregs.crcr & XHCI_CRCR_LO_CA) | ccs; xdev->opregs.crcr &= ~XHCI_CRCR_LO_CRR; return error;