| commit | 156a2e4dbffa85997636a7a39ef12da6f1b40254 | |
| author | Gerd Hoffmann <kraxel@redhat.com> | |
| Mon, 14 Dec 2015 08:21:23 +0000 (14 09:21 +0100) | ||
| committer | Gerd Hoffmann <kraxel@redhat.com> | |
| Tue, 15 Dec 2015 08:49:03 +0000 (15 09:49 +0100) | ||
| tree | c7d18840cfc024eb520ad6032ad49a48b1b5bc4b | treesnapshot (tar.gz zip) |
| parent | 93d592e3d1a45e4c0b3969e1fbbc459d6df826aa | commitdiff |
ehci: make idt processing more robust
Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction. That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.
This is CVE-2015-8558.
Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Make ehci_process_itd return an error in case we didn't do any actual
iso transfer because we've found no active transaction. That'll avoid
ehci happily run in circles forever if the guest builds a loop out of
idts.
This is CVE-2015-8558.
Cc: qemu-stable@nongnu.org
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Tested-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| hw/usb/hcd-ehci.c | diffblobblamehistory |