]> xenbits.xensource.com Git - qemu-upstream-4.4-testing.git/commit
ehci: make idt processing more robust
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 14 Dec 2015 08:21:23 +0000 (09:21 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Fri, 5 Feb 2016 14:53:53 +0000 (14:53 +0000)
commit6178660b8f4891bdf4810be5b9f9e9aabebda1ed
treecc5a547097438af2121d0c383193e39aa39d5cde
parent2600664a4e8d333290f01f0a957ea996e300bc6f
ehci: make idt processing more robust

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/usb/hcd-ehci.c