From patchwork Mon Mar 21 17:27:59 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Roth X-Patchwork-Id: 8634711 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id C606EC0553 for ; Mon, 21 Mar 2016 17:36:04 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5DA8620320 for ; Mon, 21 Mar 2016 17:35:59 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1D1CE20306 for ; Mon, 21 Mar 2016 17:35:58 +0000 (UTC) Received: from localhost ([::1]:59262 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3kD-0004hc-A2 for patchwork-qemu-devel@patchwork.kernel.org; Mon, 21 Mar 2016 13:35:57 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51594) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3ds-0001p3-LL for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ai3dp-0000zc-Ax for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:24 -0400 Received: from e36.co.us.ibm.com ([32.97.110.154]:49757) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ai3dp-0000yH-4M for qemu-devel@nongnu.org; Mon, 21 Mar 2016 13:29:21 -0400 Received: from localhost by e36.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 21 Mar 2016 11:29:20 -0600 Received: from d03dlp01.boulder.ibm.com (9.17.202.177) by e36.co.us.ibm.com (192.168.1.136) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 21 Mar 2016 11:29:19 -0600 X-IBM-Helo: d03dlp01.boulder.ibm.com X-IBM-MailFrom: mdroth@linux.vnet.ibm.com X-IBM-RcptTo: qemu-devel@nongnu.org;qemu-stable@nongnu.org Received: from b01cxnp23033.gho.pok.ibm.com (b01cxnp23033.gho.pok.ibm.com [9.57.198.28]) by d03dlp01.boulder.ibm.com (Postfix) with ESMTP id 80F84C40001; Mon, 21 Mar 2016 11:17:26 -0600 (MDT) Received: from d01av03.pok.ibm.com (d01av03.pok.ibm.com [9.56.224.217]) by b01cxnp23033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u2LHTHbd30933154; Mon, 21 Mar 2016 17:29:17 GMT Received: from d01av03.pok.ibm.com (localhost [127.0.0.1]) by d01av03.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u2LHTGBk024389; Mon, 21 Mar 2016 13:29:16 -0400 Received: from localhost ([9.80.111.41]) by d01av03.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id u2LHTFgD024371; Mon, 21 Mar 2016 13:29:16 -0400 From: Michael Roth To: qemu-devel@nongnu.org Date: Mon, 21 Mar 2016 12:27:59 -0500 Message-Id: <1458581313-19045-2-git-send-email-mdroth@linux.vnet.ibm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1458581313-19045-1-git-send-email-mdroth@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16032117-0021-0000-0000-00001AB944DF X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 32.97.110.154 Cc: Michael Roth , qemu-stable@nongnu.org, Gerd Hoffmann Subject: [Qemu-devel] [PATCH 01/35] ehci: make idt processing more robust X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Gerd Hoffmann Make ehci_process_itd return an error in case we didn't do any actual iso transfer because we've found no active transaction. That'll avoid ehci happily run in circles forever if the guest builds a loop out of idts. This is CVE-2015-8558. Cc: qemu-stable@nongnu.org Reported-by: Qinghao Tang Tested-by: P J P Signed-off-by: Gerd Hoffmann (cherry picked from commit 156a2e4dbffa85997636a7a39ef12da6f1b40254) Signed-off-by: Michael Roth --- hw/usb/hcd-ehci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 4e2161b..d07f228 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci, { USBDevice *dev; USBEndpoint *ep; - uint32_t i, len, pid, dir, devaddr, endp; + uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; uint32_t pg, off, ptr1, ptr2, max, mult; ehci->periodic_sched_active = PERIODIC_ACTIVE; @@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci, ehci_raise_irq(ehci, USBSTS_INT); } itd->transact[i] &= ~ITD_XACT_ACTIVE; + xfers++; } } - return 0; + return xfers ? 0 : -1; }