| Message ID | 20201015075957.268823-1-mcascell@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet() | expand |
On Thu, Oct 15, 2020 at 09:59:57AM +0200, Mauro Matteo Cascella wrote: > Check the value of mps to avoid potential divide-by-zero later in the function. > Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest > from crashing the QEMU process on the host. > > Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> > Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> > Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> > Reported-by: Xingwei Lin <linyi.lxw@antfin.com> > --- > Moved check earlier in the function and added "Reviewed-by" line. Added to usb queue. thanks, Gerd
On Thu, Oct 15, 2020 at 10:03 AM Mauro Matteo Cascella <mcascell@redhat.com> wrote: > > Check the value of mps to avoid potential divide-by-zero later in the function. > Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest > from crashing the QEMU process on the host. > > Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> > Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> > Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> > Reported-by: Xingwei Lin <linyi.lxw@antfin.com> Maybe also the implicit Tested-by: Paul Zimmerman <pauldzim@gmail.com> from: https://lists.gnu.org/archive/html/qemu-devel/2020-10/msg04254.html > --- > Moved check earlier in the function and added "Reviewed-by" line. > > hw/usb/hcd-dwc2.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c > index 97688d21bf..9856c4540c 100644 > --- a/hw/usb/hcd-dwc2.c > +++ b/hw/usb/hcd-dwc2.c > @@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev, > trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype], > dirs[epdir], mps, len, pcnt); > > + if (mps == 0) { > + qemu_log_mask(LOG_GUEST_ERROR, > + "%s: Bad HCCHAR_MPS set to zero\n", __func__); > + return; > + } > + > if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) { > pid = USB_TOKEN_SETUP; > } else { > -- > 2.26.2 > >
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c index 97688d21bf..9856c4540c 100644 --- a/hw/usb/hcd-dwc2.c +++ b/hw/usb/hcd-dwc2.c @@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev, trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype], dirs[epdir], mps, len, pcnt); + if (mps == 0) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: Bad HCCHAR_MPS set to zero\n", __func__); + return; + } + if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) { pid = USB_TOKEN_SETUP; } else {