Merge tag 'v1.1.2' into stable-1.1qemu-kvm-1.1.2stable-1.1

* tag 'v1.1.2': (74 commits)
  update VERSION for 1.1.2
  console: bounds check whenever changing the cursor due to an escape code
  qemu-timer: properly arm alarm timer for timers set by device initialization
  target-xtensa: return ENOSYS for unimplemented simcalls
  target-xtensa: fix big-endian BBS/BBC implementation
  ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active
  msix: make [un]use vectors on reset/load optional
  reset PMBA and PMREGMISC PIIX4 registers.
  qemu_rearm_alarm_timer: do not call rearm if the next deadline is INT64_MAX
  qemu-ga: Fix null pointer passed to unlink in failure branch
  memory: Fix copy&paste mistake in memory_region_iorange_write
  ivshmem: remove redundant ioeventfd configuration
  hw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo
  tcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code
  audio/winwave: previous audio buffer should be flushed
  target-mips: allow microMIPS SWP and SDP to have RD equal to BASE
  target-mips: add privilege level check to several Cop0 instructions
  mips-linux-user: Always support rdhwr.
  target-mips: Streamline indexed cp1 memory addressing.
  Fix order of CVT.PS.S operands
  ...

Signed-off-by: Avi Kivity <avi@redhat.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 9e211a0bb..3803f526d 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -288,10 +288,10 @@ static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
 
 static void uhci_async_cancel_all(UHCIState *s)
 {
-    UHCIQueue *queue;
+    UHCIQueue *queue, *nq;
     UHCIAsync *curr, *n;
 
-    QTAILQ_FOREACH(queue, &s->queues, next) {
+    QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
             uhci_async_unlink(curr);
             uhci_async_cancel(curr);