From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:34048) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QHeD9-0008DD-Py for qemu-devel@nongnu.org; Wed, 04 May 2011 11:42:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QHeD8-0007JM-Je for qemu-devel@nongnu.org; Wed, 04 May 2011 11:41:59 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34958) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QHeD8-0007Iv-78 for qemu-devel@nongnu.org; Wed, 04 May 2011 11:41:58 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p44Ffv2K010927 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 4 May 2011 11:41:57 -0400 From: Gerd Hoffmann Date: Wed, 4 May 2011 17:41:38 +0200 Message-Id: <1304523708-9556-5-git-send-email-kraxel@redhat.com> In-Reply-To: <1304523708-9556-1-git-send-email-kraxel@redhat.com> References: <1304523708-9556-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 04/14] usb-linux: Refuse packets for endpoints which are not in the usb descriptor List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Hans de Goede , Gerd Hoffmann From: Hans de Goede If an endpoint is not in the usb descriptor we've no idea what kind of endpoint it is and thus how to handle it, refuse packages in this case. Signed-off-by: Hans de Goede Signed-off-by: Gerd Hoffmann --- usb-linux.c | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) diff --git a/usb-linux.c b/usb-linux.c index a68603d..6aef7a5 100644 --- a/usb-linux.c +++ b/usb-linux.c @@ -94,6 +94,7 @@ static int usb_fs_type; /* endpoint association data */ #define ISO_FRAME_DESC_PER_URB 32 #define ISO_URB_COUNT 3 +#define INVALID_EP_TYPE 255 typedef struct AsyncURB AsyncURB; @@ -168,6 +169,11 @@ static int is_isoc(USBHostDevice *s, int ep) return s->endp_table[ep - 1].type == USBDEVFS_URB_TYPE_ISO; } +static int is_valid(USBHostDevice *s, int ep) +{ + return s->endp_table[ep - 1].type != INVALID_EP_TYPE; +} + static int is_halted(USBHostDevice *s, int ep) { return s->endp_table[ep - 1].halted; @@ -611,6 +617,10 @@ static int usb_host_handle_data(USBHostDevice *s, USBPacket *p) int ret; uint8_t ep; + if (!is_valid(s, p->devep)) { + return USB_RET_NAK; + } + if (p->pid == USB_TOKEN_IN) { ep = p->devep | 0x80; } else { @@ -1071,6 +1081,9 @@ static int usb_linux_update_endp_table(USBHostDevice *s) uint8_t devep, type, configuration, alt_interface; int interface, length, i; + for (i = 0; i < MAX_ENDPOINTS; i++) + s->endp_table[i].type = INVALID_EP_TYPE; + i = usb_linux_get_configuration(s); if (i < 0) return 1; -- 1.7.1