| https://bugs.gentoo.org/568246 |
| |
| From 156a2e4dbffa85997636a7a39ef12da6f1b40254 Mon Sep 17 00:00:00 2001 |
| From: Gerd Hoffmann <kraxel@redhat.com> |
| Date: Mon, 14 Dec 2015 09:21:23 +0100 |
| Subject: [PATCH] ehci: make idt processing more robust |
| |
| Make ehci_process_itd return an error in case we didn't do any actual |
| iso transfer because we've found no active transaction. That'll avoid |
| ehci happily run in circles forever if the guest builds a loop out of |
| idts. |
| |
| This is CVE-2015-8558. |
| |
| Cc: qemu-stable@nongnu.org |
| Reported-by: Qinghao Tang <luodalongde@gmail.com> |
| Tested-by: P J P <ppandit@redhat.com> |
| Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
| --- |
| hw/usb/hcd-ehci.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c |
| index 4e2161b..d07f228 100644 |
| --- a/hw/usb/hcd-ehci.c |
| +++ b/hw/usb/hcd-ehci.c |
| @@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci, |
| { |
| USBDevice *dev; |
| USBEndpoint *ep; |
| - uint32_t i, len, pid, dir, devaddr, endp; |
| + uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; |
| uint32_t pg, off, ptr1, ptr2, max, mult; |
| |
| ehci->periodic_sched_active = PERIODIC_ACTIVE; |
| @@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci, |
| ehci_raise_irq(ehci, USBSTS_INT); |
| } |
| itd->transact[i] &= ~ITD_XACT_ACTIVE; |
| + xfers++; |
| } |
| } |
| - return 0; |
| + return xfers ? 0 : -1; |
| } |
| |
| |
| -- |
| 2.6.2 |
| |