diff mbox series

[v2] hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()

Message ID 20201015075957.268823-1-mcascell@redhat.com
State New
Headers show
Series [v2] hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet() | expand

Commit Message

Mauro Matteo Cascella Oct. 15, 2020, 7:59 a.m. UTC
Check the value of mps to avoid potential divide-by-zero later in the function.
Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest
from crashing the QEMU process on the host.

Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>
Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>
Reported-by: Xingwei Lin <linyi.lxw@antfin.com>
---
Moved check earlier in the function and added "Reviewed-by" line.

 hw/usb/hcd-dwc2.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Gerd Hoffmann Oct. 15, 2020, 10:19 a.m. UTC | #1
On Thu, Oct 15, 2020 at 09:59:57AM +0200, Mauro Matteo Cascella wrote:
> Check the value of mps to avoid potential divide-by-zero later in the function.

> Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest

> from crashing the QEMU process on the host.

> 

> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>

> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>

> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>

> Reported-by: Xingwei Lin <linyi.lxw@antfin.com>

> ---

> Moved check earlier in the function and added "Reviewed-by" line.


Added to usb queue.

thanks,
  Gerd
Philippe Mathieu-Daudé Oct. 15, 2020, 11:02 a.m. UTC | #2
On Thu, Oct 15, 2020 at 10:03 AM Mauro Matteo Cascella
<mcascell@redhat.com> wrote:
>

> Check the value of mps to avoid potential divide-by-zero later in the function.

> Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest

> from crashing the QEMU process on the host.

>

> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>

> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>

> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>

> Reported-by: Xingwei Lin <linyi.lxw@antfin.com>


Maybe also the implicit
Tested-by: Paul Zimmerman <pauldzim@gmail.com>

from:
https://lists.gnu.org/archive/html/qemu-devel/2020-10/msg04254.html

> ---

> Moved check earlier in the function and added "Reviewed-by" line.

>

>  hw/usb/hcd-dwc2.c | 6 ++++++

>  1 file changed, 6 insertions(+)

>

> diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c

> index 97688d21bf..9856c4540c 100644

> --- a/hw/usb/hcd-dwc2.c

> +++ b/hw/usb/hcd-dwc2.c

> @@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev,

>      trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype],

>                                   dirs[epdir], mps, len, pcnt);

>

> +    if (mps == 0) {

> +        qemu_log_mask(LOG_GUEST_ERROR,

> +                "%s: Bad HCCHAR_MPS set to zero\n", __func__);

> +        return;

> +    }

> +

>      if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) {

>          pid = USB_TOKEN_SETUP;

>      } else {

> --

> 2.26.2

>

>
diff mbox series

Patch

diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
index 97688d21bf..9856c4540c 100644
--- a/hw/usb/hcd-dwc2.c
+++ b/hw/usb/hcd-dwc2.c
@@ -245,6 +245,12 @@  static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev,
     trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype],
                                  dirs[epdir], mps, len, pcnt);
 
+    if (mps == 0) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                "%s: Bad HCCHAR_MPS set to zero\n", __func__);
+        return;
+    }
+
     if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) {
         pid = USB_TOKEN_SETUP;
     } else {