From patchwork Thu Oct 20 07:40:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prasad Pandit X-Patchwork-Id: 9386141 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 48EAE60762 for ; Thu, 20 Oct 2016 07:40:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3166A29AD9 for ; Thu, 20 Oct 2016 07:40:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 22BB129B32; Thu, 20 Oct 2016 07:40:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7B93729AD9 for ; Thu, 20 Oct 2016 07:40:57 +0000 (UTC) Received: from localhost ([::1]:52951 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bx7yC-00044i-S3 for patchwork-qemu-devel@patchwork.kernel.org; Thu, 20 Oct 2016 03:40:56 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50085) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bx7xx-00044X-8j for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bx7xu-0007B9-2C for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:41 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41024) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1bx7xt-0007Ar-Ms for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:37 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id DC3FE624D5; Thu, 20 Oct 2016 07:40:36 +0000 (UTC) Received: from javelin.localdomain (vpn1-48-160.bne.redhat.com [10.64.48.160]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u9K7eSvp032766 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 20 Oct 2016 03:40:32 -0400 From: P J P To: Qemu Developers Date: Thu, 20 Oct 2016 13:10:24 +0530 Message-Id: <1476949224-6865-1-git-send-email-ppandit@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 20 Oct 2016 07:40:36 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] audio: intel-hda: check stream entry count during transfer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Huawei PSIRT , Gerd Hoffmann , Prasad J Pandit Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit Intel HDA emulator uses stream of buffers during DMA data transfers. Each entry has buffer length and buffer pointer position, which are used to derive bytes to 'copy'. If this length and buffer pointer were to be same, 'copy' could be set to zero(0), leading to an infinite loop. Add check to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit Reviewed-by: Stefan Hajnoczi --- hw/audio/intel-hda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340..537face 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib;