USB_TOKEN_SETUP packet not being handled in usb_ep_get function.
This causes the program to hit the assertion that checks for only
USB_TOKEN_IN or USB_TOKEN_OUT, leading to the failure and core
dump when the USB_TOKEN_SETUP packet is processed.

Added a check for USB_TOKEN_SETUP to avoid triggering an assertion
failure and crash.

Fixes: CVE-2024-8354
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2548

Signed-off-by: Madhu Marri <madmarri@cisco.com>
---
 hw/usb/core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/usb/core.c b/hw/usb/core.c
index 975f76250a..df2aec5aca 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -741,6 +741,12 @@ struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep)
     if (ep == 0) {
         return &dev->ep_ctl;
     }
+
+    if (pid == USB_TOKEN_SETUP) {
+        /* Do not handle setup packets here */
+        return &dev->ep_ctl;
+    }
+
     assert(pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT);
     assert(ep > 0 && ep <= USB_MAX_ENDPOINTS);
     eps = (pid == USB_TOKEN_IN) ? dev->ep_in : dev->ep_out;
-- 
2.44.1