提交 d688e523 编写于 作者: P Peter Maydell 提交者: Alexander Graf

hw/ide/macio: Fix segfault caused by NULL DMAContext*

Pass qemu_sglist_init the global dma_context_memory rather than a NULL
pointer; this fixes a segfault in dma_memory_map() when the guest
starts using DMA.
Reported-by: NAmadeusz Sławiński <amade@asmblr.net>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>
上级 cab1e8f3
...@@ -76,7 +76,8 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret) ...@@ -76,7 +76,8 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
s->io_buffer_size = io->len; s->io_buffer_size = io->len;
qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, NULL); qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1,
&dma_context_memory);
qemu_sglist_add(&s->sg, io->addr, io->len); qemu_sglist_add(&s->sg, io->addr, io->len);
io->addr += io->len; io->addr += io->len;
io->len = 0; io->len = 0;
...@@ -132,7 +133,8 @@ static void pmac_ide_transfer_cb(void *opaque, int ret) ...@@ -132,7 +133,8 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
s->io_buffer_index = 0; s->io_buffer_index = 0;
s->io_buffer_size = io->len; s->io_buffer_size = io->len;
qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, NULL); qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1,
&dma_context_memory);
qemu_sglist_add(&s->sg, io->addr, io->len); qemu_sglist_add(&s->sg, io->addr, io->len);
io->addr += io->len; io->addr += io->len;
io->len = 0; io->len = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册