debian/patches/extra/CVE-2016-2391-usb-ohci-avoid-multiple-eof-timers.patch

   1 From f2575bbcfe89deabe1f8eab306854d35d7418537 Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Tue, 16 Feb 2016 15:34:14 +0530
   4 Subject: [PATCH] usb: ohci avoid multiple eof timers
   5
   6 When transitioning an OHCI controller to the OHCI_USB_OPERATIONAL
   7 state, it creates an eof timer object in 'ohci_bus_start'.
   8 It does not check if one already exists. This results in memory
   9 leakage and null dereference issue. Add a check to avoid it.
  10
  11 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
  12 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  13 ---
  14  hw/usb/hcd-ohci.c | 10 +++++-----
  15  1 file changed, 5 insertions(+), 5 deletions(-)
  16
  17 diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
  18 index 7d65818..15f0b44 100644
  19 --- a/hw/usb/hcd-ohci.c
  20 +++ b/hw/usb/hcd-ohci.c
  21 @@ -1331,11 +1331,11 @@ static void ohci_frame_boundary(void *opaque)
  22   */
  23  static int ohci_bus_start(OHCIState *ohci)
  24  {
  25 -    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
  26 -                    ohci_frame_boundary,
  27 -                    ohci);
  28 -
  29 -    if (ohci->eof_timer == NULL) {
  30 +    if (!ohci->eof_timer) {
  31 +        ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
  32 +                                        ohci_frame_boundary, ohci);
  33 +    }
  34 +    if (!ohci->eof_timer) {
  35          trace_usb_ohci_bus_eof_timer_failed(ohci->name);
  36          ohci_die(ohci);
  37          return 0;
  38 --
  39 2.1.4
  40