90228ee395
This is a workaround only, and is a partial revert of a few changes to BMDMAState which removed pci_dev field on the way. - cmd646 pci_from_bm() expects bm->unit value to correspond with bm data being passed to callback as opaque pointer. This breaks when write to dma control register of second channel happens when no dma operation is in progress, so bm->unit is zero for second channel, and pci_from_bm() returns garbage pointer. Crash happens shortly after that while dereferencing that pointer. v0->v1: cleaned up dead code from pci_from_bm. Signed-off-by: Igor V. Kovalenko <igor.v.kovalenko@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> |
||
|---|---|---|
| .. | ||
| cmd646.c | ||
| core.c | ||
| internal.h | ||
| isa.c | ||
| macio.c | ||
| microdrive.c | ||
| mmio.c | ||
| pci.c | ||
| pci.h | ||
| piix.c | ||
| qdev.c | ||