usb-storage: fix NULL pointer dereference.
When a usb packet is canceled we need to check whenever we actually have
a scsi request in flight before we try to cancel it.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
diff --git a/hw/usb-msd.c b/hw/usb-msd.c
index e92434c..08d2d2a 100644
--- a/hw/usb-msd.c
+++ b/hw/usb-msd.c
@@ -325,7 +325,10 @@
static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
{
MSDState *s = DO_UPCAST(MSDState, dev, dev);
- scsi_req_cancel(s->req);
+
+ if (s->req) {
+ scsi_req_cancel(s->req);
+ }
}
static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
