]> xenbits.xensource.com Git - qemu-upstream-4.5-testing.git/commit
ehci: make idt processing more robust
authorGerd Hoffmann <kraxel@redhat.com>
Mon, 14 Dec 2015 08:21:23 +0000 (09:21 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Fri, 5 Feb 2016 14:55:01 +0000 (14:55 +0000)
commite27727dc5c9bd67e78ee4c36465ac3b23f3997d4
tree2ffa7d2a51fbedf5642dbfcbf267fb749379e11a
parent9a5a7327425fb18a210728f397df4fbc577019c7
ehci: make idt processing more robust

Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction.  That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.

This is CVE-2015-8558.

Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/usb/hcd-ehci.c