Coverity reports that ehci_writeback_async_complete_packet() ignores the return value of get_dwords() when reading the QH and qTD.
Handle read failures in the same way as QH and qTD verification failures by freeing the packet and returning early. Signed-off-by: Jamin Lin <[email protected]> Resolves: Coverity CID 1685236 Fixes: 2b3de6ada5d ("ehci: writeback_async_complete_packet: verify qh and qtd") Reviewed-by: Philippe Mathieu-Daudé <[email protected]> --- hw/usb/hcd-ehci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 5187ecc7e4..f371e567f3 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -527,11 +527,11 @@ static void ehci_writeback_async_complete_packet(EHCIPacket *p) /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ memset(&qh, 0, sizeof(qh)); memset(&qtd, 0, sizeof(qtd)); - get_dwords(q->ehci, NLPTR_GET(q->qhaddr), - (uint32_t *) &qh, ehci_qh_dwords(q->ehci)); - get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), - (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci)); - if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { + if (!get_dwords(q->ehci, NLPTR_GET(q->qhaddr), + (uint32_t *) &qh, ehci_qh_dwords(q->ehci)) || + !get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), + (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci)) || + !ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { p->async = EHCI_ASYNC_INITIALIZED; ehci_free_packet(p); return; -- 2.53.0
