[Xen-changelog] [qemu-xen stable-4.5] ehci: make idt processing more robust

[patchbot@xxxxxxx]

commit e27727dc5c9bd67e78ee4c36465ac3b23f3997d4
Author:     Gerd Hoffmann <kraxel@xxxxxxxxxx>
AuthorDate: Mon Dec 14 09:21:23 2015 +0100
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Fri Feb 5 14:55:01 2016 +0000

    ehci: make idt processing more robust
    
    Make ehci_process_itd return an error in case we didn't do any actual
    iso transfer because we've found no active transaction.  That'll avoid
    ehci happily run in circles forever if the guest builds a loop out of
    idts.
    
    This is CVE-2015-8558.
    
    Cc: qemu-stable@xxxxxxxxxx
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Tested-by: P J P <ppandit@xxxxxxxxxx>
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
---
 hw/usb/hcd-ehci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index c281555..5176a64 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1472,7 +1472,7 @@ static int ehci_process_itd(EHCIState *ehci,
 {
     USBDevice *dev;
     USBEndpoint *ep;
-    uint32_t i, len, pid, dir, devaddr, endp;
+    uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
     uint32_t pg, off, ptr1, ptr2, max, mult;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
@@ -1564,9 +1564,10 @@ static int ehci_process_itd(EHCIState *ehci,
                 ehci_raise_irq(ehci, USBSTS_INT);
             }
             itd->transact[i] &= ~ITD_XACT_ACTIVE;
+            xfers++;
         }
     }
-    return 0;
+    return xfers ? 0 : -1;
 }
 
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.5

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog