From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51316) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a8mRX-000186-SN for qemu-devel@nongnu.org; Tue, 15 Dec 2015 05:02:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a8mRU-0006qN-F0 for qemu-devel@nongnu.org; Tue, 15 Dec 2015 05:02:51 -0500 From: Gerd Hoffmann Date: Tue, 15 Dec 2015 11:02:33 +0100 Message-Id: <1450173753-14562-6-git-send-email-kraxel@redhat.com> In-Reply-To: <1450173753-14562-1-git-send-email-kraxel@redhat.com> References: <1450173753-14562-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 5/5] ehci: make idt processing more robust List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , qemu-stable@nongnu.org Make ehci_process_itd return an error in case we didn't do any actual iso transfer because we've found no active transaction. That'll avoid ehci happily run in circles forever if the guest builds a loop out of idts. This is CVE-2015-8558. Cc: qemu-stable@nongnu.org Reported-by: Qinghao Tang Tested-by: P J P Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-ehci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 4e2161b..d07f228 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci, { USBDevice *dev; USBEndpoint *ep; - uint32_t i, len, pid, dir, devaddr, endp; + uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; uint32_t pg, off, ptr1, ptr2, max, mult; ehci->periodic_sched_active = PERIODIC_ACTIVE; @@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci, ehci_raise_irq(ehci, USBSTS_INT); } itd->transact[i] &= ~ITD_XACT_ACTIVE; + xfers++; } } - return 0; + return xfers ? 0 : -1; } -- 1.8.3.1