]>
Commit | Line | Data |
---|---|---|
1 | From: Gerd Hoffmann | |
2 | Subject: [Qemu-devel] [PULL 5/5] ehci: make idt processing more robust | |
3 | ||
4 | Make ehci_process_itd return an error in case we didn't do any actual | |
5 | iso transfer because we've found no active transaction. That'll avoid | |
6 | ehci happily run in circles forever if the guest builds a loop out of | |
7 | idts. | |
8 | ||
9 | This is CVE-2015-8558. | |
10 | ||
11 | Cc: qemu-stable@nongnu.org | |
12 | Reported-by: Qinghao Tang <luodalongde@gmail.com> | |
13 | Tested-by: P J P <ppandit@redhat.com> | |
14 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | |
15 | --- | |
16 | hw/usb/hcd-ehci.c | 5 +++-- | |
17 | 1 file changed, 3 insertions(+), 2 deletions(-) | |
18 | ||
19 | diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c | |
20 | index 4e2161b..d07f228 100644 | |
21 | --- a/hw/usb/hcd-ehci.c | |
22 | +++ b/hw/usb/hcd-ehci.c | |
23 | @@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci, | |
24 | { | |
25 | USBDevice *dev; | |
26 | USBEndpoint *ep; | |
27 | - uint32_t i, len, pid, dir, devaddr, endp; | |
28 | + uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; | |
29 | uint32_t pg, off, ptr1, ptr2, max, mult; | |
30 | ||
31 | ehci->periodic_sched_active = PERIODIC_ACTIVE; | |
32 | @@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci, | |
33 | ehci_raise_irq(ehci, USBSTS_INT); | |
34 | } | |
35 | itd->transact[i] &= ~ITD_XACT_ACTIVE; | |
36 | + xfers++; | |
37 | } | |
38 | } | |
39 | - return 0; | |
40 | + return xfers ? 0 : -1; | |
41 | } | |
42 | ||
43 | ||
44 | -- | |
45 | 1.8.3.1 | |
46 | ||
47 | ||
48 | ||
49 |