| Message ID | 20201105134112.25119-7-kraxel@redhat.com |
|---|---|
| State | Accepted |
| Commit | c590fe3aa23acb923159c41c741dd694cba9c544 |
| Headers | show |
| Series | usb: fix some guest-triggerable asserts | expand |
On 11/5/20 2:41 PM, Gerd Hoffmann wrote: > The v variable goes negative for reg < 0x20. Reorder the code > to first sanity check then calculate v and assign intr to make > sanity checkers happy. > > Buglink: https://bugs.launchpad.net/qemu/+bug/1902112 > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> > --- > hw/usb/hcd-xhci.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index d00bb0141dac..6dfb17cbe915 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -3010,14 +3010,17 @@ static void xhci_runtime_write(void *ptr, hwaddr reg, uint64_t val, unsigned size) { XHCIState *xhci = ptr; - int v = (reg - 0x20) / 0x20; - XHCIInterrupter *intr = &xhci->intr[v]; + XHCIInterrupter *intr; + int v; + trace_usb_xhci_runtime_write(reg, val); if (reg < 0x20) { trace_usb_xhci_unimplemented("runtime write", reg); return; } + v = (reg - 0x20) / 0x20; + intr = &xhci->intr[v]; switch (reg & 0x1f) { case 0x00: /* IMAN */
The v variable goes negative for reg < 0x20. Reorder the code to first sanity check then calculate v and assign intr to make sanity checkers happy. Buglink: https://bugs.launchpad.net/qemu/+bug/1902112 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> --- hw/usb/hcd-xhci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)