[Xen-changelog] [qemu-xen master] ehci: make idt processing more robust

[patchbot@xxxxxxx]

commit c2f9b626486cb6407aa067cac5c62dbbe84d9d8d
Author:     Gerd Hoffmann <kraxel@xxxxxxxxxx>
AuthorDate: Mon Dec 14 09:21:23 2015 +0100
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Fri Feb 5 12:13:40 2016 +0000

    ehci: make idt processing more robust
    
    Make ehci_process_itd return an error in case we didn't do any actual
    iso transfer because we've found no active transaction.  That'll avoid
    ehci happily run in circles forever if the guest builds a loop out of
    idts.
    
    This is CVE-2015-8558.
    
    Cc: qemu-stable@xxxxxxxxxx
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Tested-by: P J P <ppandit@xxxxxxxxxx>
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
---
 hw/usb/hcd-ehci.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 86d4529..d829901 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci,
 {
     USBDevice *dev;
     USBEndpoint *ep;
-    uint32_t i, len, pid, dir, devaddr, endp;
+    uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
     uint32_t pg, off, ptr1, ptr2, max, mult;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
@@ -1481,9 +1481,10 @@ static int ehci_process_itd(EHCIState *ehci,
                 ehci_raise_irq(ehci, USBSTS_INT);
             }
             itd->transact[i] &= ~ITD_XACT_ACTIVE;
+            xfers++;
         }
     }
-    return 0;
+    return xfers ? 0 : -1;
 }
 
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog