Re: [Qemu-devel] [PATCH 1/2] ehci: apply limit to itd/sidt descriptors

[P J P]

+-- On Mon, 18 Apr 2016, Gerd Hoffmann wrote --+
| Commit "156a2e4 ehci: make idt processing more robust" tries to avoid a
| DoS by the guest (create a circular itd queue and let qemu ehci
| emulation run in circles forever).  Unfortunaly this has two problems:
| First it misses the case of sitds, and second it reportly breaks
| freebsd.
| 
| So lets go for a different approach: just count the number of itds and
| sitds we have seen per frame and apply a limit.  That should really
| catch all cases now.

  idt -> iTD
  sidt -> siTD
  Unfortualy -> Unfortunately
  reportly -> reportedly
  freebsd -> FreeBSD

Perhaps it'll help to add "Fixes: 156a2e4(CVE-2015-8558)" to the commit log? 
(just a thought)

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F