[Qemu-devel] [PULL 0/1] audio: intel-hda: check stream entry count during transfer

[Qemu-devel] [PULL 0/1] audio: intel-hda: check stream entry count during transfer

[Gerd Hoffmann]

  Hi,

Audio patch queue with a single intel hda bugfix.

please pull,
  Gerd

The following changes since commit ede0cbeb7892bdf4a19128853a3a3c61a17fb068:

  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-10-25' into staging (2016-10-25 17:03:11 +0100)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-audio-20161027-1

for you to fetch changes up to 0c0fc2b5fd534786051889459848764edd798050:

  audio: intel-hda: check stream entry count during transfer (2016-10-26 14:51:44 +0200)

----------------------------------------------------------------
audio: intel-hda: check stream entry count during transfer

----------------------------------------------------------------
Prasad J Pandit (1):
      audio: intel-hda: check stream entry count during transfer

 hw/audio/intel-hda.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

[Qemu-devel] [PULL 1/1] audio: intel-hda: check stream entry count during transfer

[Gerd Hoffmann]

From: Prasad J Pandit <pjp@fedoraproject.org>

Intel HDA emulator uses stream of buffers during DMA data
transfers. Each entry has buffer length and buffer pointer
position, which are used to derive bytes to 'copy'. If this
length and buffer pointer were to be same, 'copy' could be
set to zero(0), leading to an infinite loop. Add check to
avoid it.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/audio/intel-hda.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index cd95340..537face 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
     }
 
     left = len;
-    while (left > 0) {
+    s = st->bentries;
+    while (left > 0 && s-- > 0) {
         copy = left;
         if (copy > st->bsize - st->lpib)
             copy = st->bsize - st->lpib;
-- 
1.8.3.1

Re: [Qemu-devel] [PULL 0/1] audio: intel-hda: check stream entry count during transfer

[Peter Maydell]

On 27 October 2016 at 15:32, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Audio patch queue with a single intel hda bugfix.
>
> please pull,
>   Gerd
>
> The following changes since commit ede0cbeb7892bdf4a19128853a3a3c61a17fb068:
>
>   Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-10-25' into staging (2016-10-25 17:03:11 +0100)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-audio-20161027-1
>
> for you to fetch changes up to 0c0fc2b5fd534786051889459848764edd798050:
>
>   audio: intel-hda: check stream entry count during transfer (2016-10-26 14:51:44 +0200)
>
> ----------------------------------------------------------------
> audio: intel-hda: check stream entry count during transfer
>
> ----------------------------------------------------------------
> Prasad J Pandit (1):
>       audio: intel-hda: check stream entry count during transfer
>

Applied, thanks.

-- PMM