Check the value of mps to avoid potential divide-by-zero later in the function.
Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest
from crashing the QEMU process on the host.
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>
Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>
Reported-by: Xingwei Lin <linyi.lxw@antfin.com>
---
Moved check earlier in the function and added "Reviewed-by" line.
hw/usb/hcd-dwc2.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
index 97688d21bf..9856c4540c 100644
--- a/hw/usb/hcd-dwc2.c
+++ b/hw/usb/hcd-dwc2.c
@@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev,
trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype],
dirs[epdir], mps, len, pcnt);
+ if (mps == 0) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Bad HCCHAR_MPS set to zero\n", __func__);
+ return;
+ }
+
if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) {
pid = USB_TOKEN_SETUP;
} else {
--
2.26.2
On Thu, Oct 15, 2020 at 10:03 AM Mauro Matteo Cascella <mcascell@redhat.com> wrote: > > Check the value of mps to avoid potential divide-by-zero later in the function. > Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest > from crashing the QEMU process on the host. > > Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> > Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> > Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> > Reported-by: Xingwei Lin <linyi.lxw@antfin.com> Maybe also the implicit Tested-by: Paul Zimmerman <pauldzim@gmail.com> from: https://lists.gnu.org/archive/html/qemu-devel/2020-10/msg04254.html > --- > Moved check earlier in the function and added "Reviewed-by" line. > > hw/usb/hcd-dwc2.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c > index 97688d21bf..9856c4540c 100644 > --- a/hw/usb/hcd-dwc2.c > +++ b/hw/usb/hcd-dwc2.c > @@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev, > trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype], > dirs[epdir], mps, len, pcnt); > > + if (mps == 0) { > + qemu_log_mask(LOG_GUEST_ERROR, > + "%s: Bad HCCHAR_MPS set to zero\n", __func__); > + return; > + } > + > if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) { > pid = USB_TOKEN_SETUP; > } else { > -- > 2.26.2 > >
On Thu, Oct 15, 2020 at 09:59:57AM +0200, Mauro Matteo Cascella wrote: > Check the value of mps to avoid potential divide-by-zero later in the function. > Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest > from crashing the QEMU process on the host. > > Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> > Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> > Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> > Reported-by: Xingwei Lin <linyi.lxw@antfin.com> > --- > Moved check earlier in the function and added "Reviewed-by" line. Added to usb queue. thanks, Gerd
© 2016 - 2024 Red Hat, Inc.