50 lines
1.9 KiB
Diff
50 lines
1.9 KiB
Diff
|
From 02d63f9fd9655f1899dabbccaf0568bfaa3e97df Mon Sep 17 00:00:00 2001
|
||
|
|
From: Li Qiang <liq3ea@163.com>
|
||
|
|
Date: Wed, 12 Aug 2020 09:17:27 -0700
|
||
|
|
Subject: [PATCH] hw: ehci: check return value of 'usb_packet_map'
|
||
|
|
|
||
|
|
If 'usb_packet_map' fails, we should stop to process the usb
|
||
|
|
request.
|
||
|
|
|
||
|
|
Signed-off-by: Li Qiang <liq3ea@163.com>
|
||
|
|
Message-Id: <20200812161727.29412-1-liq3ea@163.com>
|
||
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||
|
|
(cherry-picked from 2fdb42d8)
|
||
|
|
Fix CVE-2020-25723
|
||
|
|
Signed-off-by: Alex Chen <alex.chen@huawei.com>
|
||
|
|
---
|
||
|
|
hw/usb/hcd-ehci.c | 10 ++++++++--
|
||
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
|
||
|
|
index 5f089f3005..433e6a4fc0 100644
|
||
|
|
--- a/hw/usb/hcd-ehci.c
|
||
|
|
+++ b/hw/usb/hcd-ehci.c
|
||
|
|
@@ -1370,7 +1370,10 @@ static int ehci_execute(EHCIPacket *p, const char *action)
|
||
|
|
spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
|
||
|
|
usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
|
||
|
|
(p->qtd.token & QTD_TOKEN_IOC) != 0);
|
||
|
|
- usb_packet_map(&p->packet, &p->sgl);
|
||
|
|
+ if (usb_packet_map(&p->packet, &p->sgl)) {
|
||
|
|
+ qemu_sglist_destroy(&p->sgl);
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
p->async = EHCI_ASYNC_INITIALIZED;
|
||
|
|
}
|
||
|
|
|
||
|
|
@@ -1449,7 +1452,10 @@ static int ehci_process_itd(EHCIState *ehci,
|
||
|
|
if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
|
||
|
|
usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
|
||
|
|
(itd->transact[i] & ITD_XACT_IOC) != 0);
|
||
|
|
- usb_packet_map(&ehci->ipacket, &ehci->isgl);
|
||
|
|
+ if (usb_packet_map(&ehci->ipacket, &ehci->isgl)) {
|
||
|
|
+ qemu_sglist_destroy(&ehci->isgl);
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
usb_handle_packet(dev, &ehci->ipacket);
|
||
|
|
usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
|
||
|
|
} else {
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|