[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 16/56] usb/ohci: Fix crash with when specifying too
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 16/56] usb/ohci: Fix crash with when specifying too many num-ports |
Date: |
Mon, 8 Aug 2016 16:03:47 -0500 |
From: Thomas Huth <address@hidden>
QEMU currently crashes when an OHCI controller is instantiated with
too many ports, e.g. "-device pci-ohci,num-ports=100,masterbus=1".
Thus add a proper check in usb_ohci_init() to make sure that we
do not use more than OHCI_MAX_PORTS = 15 ports here.
Ticket: https://bugs.launchpad.net/qemu/+bug/1581308
Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit d400fc018b326104d26d730e5cc8c36c1f662c34)
Signed-off-by: Michael Roth <address@hidden>
---
hw/usb/hcd-ohci.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index ffab561..16d9ff7 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1848,6 +1848,12 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState
*dev,
ohci->as = as;
+ if (num_ports > OHCI_MAX_PORTS) {
+ error_setg(errp, "OHCI num-ports=%d is too big (limit is %d ports)",
+ num_ports, OHCI_MAX_PORTS);
+ return;
+ }
+
if (usb_frame_time == 0) {
#ifdef OHCI_TIME_WARP
usb_frame_time = NANOSECONDS_PER_SECOND;
--
1.9.1
- [Qemu-devel] [PATCH 00/56] Patch Round-up for stable 2.6.1, freeze on 2016-08-12, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 09/56] configure: Allow builds with extra warnings, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 10/56] migration: regain control of images when migration fails to complete, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 11/56] json-streamer: Don't leak tokens on incomplete parse, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 12/56] json-streamer: fix double-free on exiting during a parse, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 13/56] esp: check command buffer length before write(CVE-2016-4439), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 15/56] block/nfs: refuse readahead if cache.direct is on, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 16/56] usb/ohci: Fix crash with when specifying too many num-ports,
Michael Roth <=
- [Qemu-devel] [PATCH 17/56] vga: add sr_vbe register set, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 14/56] esp: check dma length before reading scsi command(CVE-2016-4441), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 22/56] Fix configure test for PBKDF2 in nettle, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 18/56] vfio: Fix broken EEH, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 20/56] nbd: Don't trim unrequested bytes, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 01/56] i386: kvmvapic: initialise imm32 variable, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 21/56] savevm: fail if migration blockers are present, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 24/56] scsi: mptsas: infinite loop while fetching requests, Michael Roth, 2016/08/08