From: P J P <ppandit@redhat.com>
To: Gerd Hoffmann <kraxel@redhat.com>
Cc: Prasad J Pandit <pjp@fedoraproject.org>,
Li Qiang <liq3ea@gmail.com>,
QEMU Developers <qemu-devel@nongnu.org>,
Yi Ren <yunye.ry@alibaba-inc.com>,
Yongkang Jia <j_kangel@163.com>, Gaoning Pan <pgn@zju.edu.cn>
Subject: [PATCH v2 0/2] hw: usb: hcd-ohci: fix oob access and loop issues
Date: Tue, 15 Sep 2020 23:52:57 +0530 [thread overview]
Message-ID: <20200915182259.68522-1-ppandit@redhat.com> (raw)
From: Prasad J Pandit <pjp@fedoraproject.org>
Hello,
* While servicing transfer descriptors(TD) in ohci_service[_iso]_td
routines, it may lead to out-of-bounds access and/or infinite loop
issues, as the OHCI controller driver may supply malicious values
to derive frame_number, start_addr, end_addr etc. variables.
* This series breaks earlier single patch into two.
One for an out-of-bounds access issue and another to fix infinite
loop case.
-> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05145.html
Thank you.
--
Prasad J Pandit (2):
hw: usb: hcd-ohci: check len and frame_number variables
hw: usb: hcd-ohci: check for processed TD before retire
hw/usb/hcd-ohci.c | 28 ++++++++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
--
2.26.2
next reply other threads:[~2020-09-15 18:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-15 18:22 P J P [this message]
2020-09-15 18:22 ` [PATCH v2 1/2] hw: usb: hcd-ohci: check len and frame_number variables P J P
2020-09-15 18:22 ` [PATCH v2 2/2] hw: usb: hcd-ohci: check for processed TD before retire P J P
2020-09-16 14:51 ` Li Qiang
2020-09-21 7:53 ` [PATCH v2 0/2] hw: usb: hcd-ohci: fix oob access and loop issues Gerd Hoffmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200915182259.68522-1-ppandit@redhat.com \
--to=ppandit@redhat.com \
--cc=j_kangel@163.com \
--cc=kraxel@redhat.com \
--cc=liq3ea@gmail.com \
--cc=pgn@zju.edu.cn \
--cc=pjp@fedoraproject.org \
--cc=qemu-devel@nongnu.org \
--cc=yunye.ry@alibaba-inc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).