debian/patches/extra/CVE-2015-8558-ehci_make_idt_processing_more_robust.patch

   1 From: Gerd Hoffmann
   2 Subject: [Qemu-devel] [PULL 5/5] ehci: make idt processing more robust
   3
   4 Make ehci_process_itd return an error in case we didn't do any actual
   5 iso transfer because we've found no active transaction.  That'll avoid
   6 ehci happily run in circles forever if the guest builds a loop out of
   7 idts.
   8
   9 This is CVE-2015-8558.
  10
  11 Cc: qemu-stable@nongnu.org
  12 Reported-by: Qinghao Tang <luodalongde@gmail.com>
  13 Tested-by: P J P <ppandit@redhat.com>
  14 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  15 ---
  16  hw/usb/hcd-ehci.c | 5 +++--
  17  1 file changed, 3 insertions(+), 2 deletions(-)
  18
  19 diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
  20 index 4e2161b..d07f228 100644
  21 --- a/hw/usb/hcd-ehci.c
  22 +++ b/hw/usb/hcd-ehci.c
  23 @@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci,
  24  {
  25      USBDevice *dev;
  26      USBEndpoint *ep;
  27 -    uint32_t i, len, pid, dir, devaddr, endp;
  28 +    uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
  29      uint32_t pg, off, ptr1, ptr2, max, mult;
  30
  31      ehci->periodic_sched_active = PERIODIC_ACTIVE;
  32 @@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci,
  33                  ehci_raise_irq(ehci, USBSTS_INT);
  34              }
  35              itd->transact[i] &= ~ITD_XACT_ACTIVE;
  36 +            xfers++;
  37          }
  38      }
  39 -    return 0;
  40 +    return xfers ? 0 : -1;
  41  }
  42
  43
  44 --
  45 1.8.3.1
  46
  47
  48
  49