[Qemu-devel] [PULL 0/2] usb: two ehci fixes.

[Qemu-devel] [PULL 0/2] usb: two ehci fixes.

[Gerd Hoffmann]

  Hi,

Here is the usb patch queue with two ehci fixes.

please pull,
  Gerd

The following changes since commit 10ae9d76388e3f4a31f6a1475b5e2d1f28404a10:

  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160201' into staging (2016-02-02 09:13:10 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-usb-20160202-1

for you to fetch changes up to 5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66:

  ehci: update irq on reset (2016-02-02 14:11:01 +0100)

----------------------------------------------------------------
usb: two ehci fixes.

----------------------------------------------------------------
Gerd Hoffmann (1):
      ehci: update irq on reset

Prasad J Pandit (1):
      usb: check page select value while processing iTD

 hw/usb/hcd-ehci.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

[Qemu-devel] [PULL 1/2] usb: check page select value while processing iTD

[Gerd Hoffmann]

From: Prasad J Pandit <pjp@fedoraproject.org>

While processing isochronous transfer descriptors(iTD), the page
select(PG) field value could lead to an OOB read access. Add
check to avoid it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1453233406-12165-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-ehci.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index ab00268..93601d9 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1405,21 +1405,23 @@ static int ehci_process_itd(EHCIState *ehci,
         if (itd->transact[i] & ITD_XACT_ACTIVE) {
             pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
             off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
-            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
-            ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
             len  = get_field(itd->transact[i], ITD_XACT_LENGTH);
 
             if (len > max * mult) {
                 len = max * mult;
             }
-
-            if (len > BUFF_SIZE) {
+            if (len > BUFF_SIZE || pg > 6) {
                 return -1;
             }
 
+            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
             qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
             if (off + len > 4096) {
                 /* transfer crosses page border */
+                if (pg == 6) {
+                    return -1;  /* avoid page pg + 1 */
+                }
+                ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
                 uint32_t len2 = off + len - 4096;
                 uint32_t len1 = len - len2;
                 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
-- 
1.8.3.1

[Qemu-devel] [PULL 2/2] ehci: update irq on reset

[Gerd Hoffmann]

After clearing the status register we also have to update the irq line
status.  Otherwise a irq which happends to be pending at reset time
causes a interrupt storm.  And the guest can't stop as the status
register doesn't indicate any pending interrupt.

Both NetBSD and FreeBSD hang on shutdown because of that.

Cc: qemu-stable@nongnu.org
Reported-by: Andrey Korolyov <andrey@xdel.ru>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1453203884-4125-1-git-send-email-kraxel@redhat.com
---
 hw/usb/hcd-ehci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 93601d9..1b50601 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -866,6 +866,7 @@ void ehci_reset(void *opaque)
     s->usbsts = USBSTS_HALT;
     s->usbsts_pending = 0;
     s->usbsts_frindex = 0;
+    ehci_update_irq(s);
 
     s->astate = EST_INACTIVE;
     s->pstate = EST_INACTIVE;
-- 
1.8.3.1

Re: [Qemu-devel] [PULL 0/2] usb: two ehci fixes.

[Peter Maydell]

On 2 February 2016 at 13:20, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here is the usb patch queue with two ehci fixes.
>
> please pull,
>   Gerd
>
> The following changes since commit 10ae9d76388e3f4a31f6a1475b5e2d1f28404a10:
>
>   Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160201' into staging (2016-02-02 09:13:10 +0000)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-usb-20160202-1
>
> for you to fetch changes up to 5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66:
>
>   ehci: update irq on reset (2016-02-02 14:11:01 +0100)
>
> ----------------------------------------------------------------
> usb: two ehci fixes.
>

Applied, thanks.

-- PMM