[Xen-changelog] [qemu-xen stable-4.6] ehci: make idt processing more robust

[patchbot@xxxxxxx]

commit a028c96f0f10db221e07eb0524c01b77aaa42341
Author:     Gerd Hoffmann <kraxel@xxxxxxxxxx>
AuthorDate: Mon Dec 14 09:21:23 2015 +0100
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Fri Feb 5 13:58:51 2016 +0000

    ehci: make idt processing more robust
    
    Make ehci_process_itd return an error in case we didn't do any actual
    iso transfer because we've found no active transaction.  That'll avoid
    ehci happily run in circles forever if the guest builds a loop out of
    idts.
    
    This is CVE-2015-8558.
    
    Cc: qemu-stable@xxxxxxxxxx
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Tested-by: P J P <ppandit@xxxxxxxxxx>
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
---
 hw/usb/hcd-ehci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 07dfb2e..d04472d 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1395,7 +1395,7 @@ static int ehci_process_itd(EHCIState *ehci,
 {
     USBDevice *dev;
     USBEndpoint *ep;
-    uint32_t i, len, pid, dir, devaddr, endp;
+    uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
     uint32_t pg, off, ptr1, ptr2, max, mult;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
@@ -1487,9 +1487,10 @@ static int ehci_process_itd(EHCIState *ehci,
                 ehci_raise_irq(ehci, USBSTS_INT);
             }
             itd->transact[i] &= ~ITD_XACT_ACTIVE;
+            xfers++;
         }
     }
-    return 0;
+    return xfers ? 0 : -1;
 }
 
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog