| Andrew Geissler | c723b72 | 2021-01-08 16:14:09 -0600 | [diff] [blame] | 1 | From 2fdb42d840400d58f2e706ecca82c142b97bcbd6 Mon Sep 17 00:00:00 2001 |
| 2 | From: Li Qiang <liq3ea@163.com> |
| 3 | Date: Wed, 12 Aug 2020 09:17:27 -0700 |
| 4 | Subject: [PATCH] hw: ehci: check return value of 'usb_packet_map' |
| 5 | |
| 6 | If 'usb_packet_map' fails, we should stop to process the usb |
| 7 | request. |
| 8 | |
| 9 | Signed-off-by: Li Qiang <liq3ea@163.com> |
| 10 | Message-Id: <20200812161727.29412-1-liq3ea@163.com> |
| 11 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
| 12 | |
| 13 | Upstream-Status: Backport |
| 14 | CVE: CVE-2020-25723 |
| 15 | [https://git.qemu.org/?p=qemu.git;a=commit;h=2fdb42d840400d58f2e706ecca82c142b97bcbd6] |
| 16 | Signed-off-by: Li Wang <li.wang@windriver.com> |
| 17 | --- |
| 18 | hw/usb/hcd-ehci.c | 10 ++++++++-- |
| 19 | 1 file changed, 8 insertions(+), 2 deletions(-) |
| 20 | |
| 21 | diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c |
| 22 | index 1495e8f..1fbb02a 100644 |
| 23 | --- a/hw/usb/hcd-ehci.c |
| 24 | +++ b/hw/usb/hcd-ehci.c |
| 25 | @@ -1373,7 +1373,10 @@ static int ehci_execute(EHCIPacket *p, const char *action) |
| 26 | spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); |
| 27 | usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, |
| 28 | (p->qtd.token & QTD_TOKEN_IOC) != 0); |
| 29 | - usb_packet_map(&p->packet, &p->sgl); |
| 30 | + if (usb_packet_map(&p->packet, &p->sgl)) { |
| 31 | + qemu_sglist_destroy(&p->sgl); |
| 32 | + return -1; |
| 33 | + } |
| 34 | p->async = EHCI_ASYNC_INITIALIZED; |
| 35 | } |
| 36 | |
| 37 | @@ -1452,7 +1455,10 @@ static int ehci_process_itd(EHCIState *ehci, |
| 38 | if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { |
| 39 | usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, |
| 40 | (itd->transact[i] & ITD_XACT_IOC) != 0); |
| 41 | - usb_packet_map(&ehci->ipacket, &ehci->isgl); |
| 42 | + if (usb_packet_map(&ehci->ipacket, &ehci->isgl)) { |
| 43 | + qemu_sglist_destroy(&ehci->isgl); |
| 44 | + return -1; |
| 45 | + } |
| 46 | usb_handle_packet(dev, &ehci->ipacket); |
| 47 | usb_packet_unmap(&ehci->ipacket, &ehci->isgl); |
| 48 | } else { |
| 49 | -- |
| 50 | 2.17.1 |
| 51 | |