From: Li Qiang <liqiang6-s@360.cn>
Date: Mon, 19 Sep 2016 02:48:35 +0000 (-0700)
Subject: usb: ehci: fix memory leak in ehci_process_itd
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=b16c129daf0fed91febbb88de23dae8271c8898a;p=qemu.git

usb: ehci: fix memory leak in ehci_process_itd

While processing isochronous transfer descriptors(iTD), if the page
select(PG) field value is out of bands it will return. In this
situation the ehci's sg list is not freed thus leading to a memory
leak issue. This patch avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index b093db729c..f4ece9abed 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1426,6 +1426,7 @@ static int ehci_process_itd(EHCIState *ehci,
             if (off + len > 4096) {
                 /* transfer crosses page border */
                 if (pg == 6) {
+                    qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
                 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);