]> xenbits.xensource.com Git - qemu-upstream-4.3-testing.git/commit
ehci: make idt processing more robust
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 14 Dec 2015 08:21:23 +0000 (09:21 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Fri, 5 Feb 2016 14:47:09 +0000 (14:47 +0000)
commit36b4f8a6fe38e1bd3c8ec51d4f6e168d05282713
treea122ac48c44c755a98c8961f6606bad0cf7efedd
parent921412688e6e0373097e3ab808e08fdacb20bac9
ehci: make idt processing more robust

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/usb/hcd-ehci.c