[Qemu-devel] [PATCH] usb-storage: fix NULL pointer dereference.

[Gerd Hoffmann]

When a usb packet is canceled we need to check whenever we actually have
a scsi request in flight before we try to cancel it.

Signed-off-by: Gerd Hoffmann <address@hidden>
---
 hw/usb-msd.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/hw/usb-msd.c b/hw/usb-msd.c
index 591405b..b74c46e 100644
--- a/hw/usb-msd.c
+++ b/hw/usb-msd.c
@@ -315,7 +315,10 @@ static int usb_msd_handle_control(USBDevice *dev, 
USBPacket *p,
 static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
 {
     MSDState *s = DO_UPCAST(MSDState, dev, dev);
-    scsi_req_cancel(s->req);
+
+    if (s->req) {
+        scsi_req_cancel(s->req);
+    }
 }
 
 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
-- 
1.7.1