mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ehci: make idt processing more robust

Browse Source 
Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2015-12-14 09:21:23 +01:00
parent 93d592e3d1
commit 156a2e4dbf
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/usb/hcd-ehci.c
View File

@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci,
{ {
USBDevice *dev; USBDevice *dev;
USBEndpoint *ep; USBEndpoint *ep;
uint32_t i, len, pid, dir, devaddr, endp; uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
uint32_t pg, off, ptr1, ptr2, max, mult; uint32_t pg, off, ptr1, ptr2, max, mult;
ehci->periodic_sched_active = PERIODIC_ACTIVE; ehci->periodic_sched_active = PERIODIC_ACTIVE;
@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci,
ehci_raise_irq(ehci, USBSTS_INT); ehci_raise_irq(ehci, USBSTS_INT);
} }
itd->transact[i] &= ~ITD_XACT_ACTIVE; itd->transact[i] &= ~ITD_XACT_ACTIVE;
xfers++;
} }
} }
return 0; return xfers ? 0 : -1;
} }