[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/7] usb/xhci: avoid trigger assertion if guest write
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 4/7] usb/xhci: avoid trigger assertion if guest write wrong epid |
Date: |
Fri, 3 May 2019 08:59:51 +0200 |
From: Longpeng <address@hidden>
we found the following core in our environment:
0 0x00007fc6b06c2237 in raise ()
1 0x00007fc6b06c3928 in abort ()
2 0x00007fc6b06bb056 in __assert_fail_base ()
3 0x00007fc6b06bb102 in __assert_fail ()
4 0x0000000000702e36 in xhci_kick_ep (...)
5 0x000000000047897a in memory_region_write_accessor (...)
6 0x000000000047767f in access_with_adjusted_size (...)
7 0x000000000047944d in memory_region_dispatch_write (...)
(address@hidden, address@hidden, data=1648892416,
address@hidden, address@hidden)
8 0x000000000042df17 in address_space_write_continue (...)
10 0x000000000043084d in address_space_rw (...)
11 0x000000000047451b in kvm_cpu_exec (address@hidden)
12 0x000000000045dcf5 in qemu_kvm_cpu_thread_fn (arg=0x1ab11b0)
13 0x0000000000870631 in qemu_thread_start (address@hidden)
14 0x00000000008959a7 in thread_entry_for_hotfix (pthread_cb=<optimized out>)
15 0x00007fc6b0a60dd5 in start_thread ()
16 0x00007fc6b078a59d in clone ()
(gdb) f 5
5 0x000000000047897a in memory_region_write_accessor (...)
529 mr->ops->write(mr->opaque, addr, tmp, size);
(gdb) p /x tmp
$9 = 0x62481a00 <-- last byte 0x00 is @epid
xhci_doorbell_write() already check the upper bound of @slotid an @epid,
it also need to check the lower bound.
Cc: Gonglei <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Longpeng <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
[ kraxel: fixed typo in subject line ]
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/usb/hcd-xhci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index ec28bee31963..d8472b4fea7f 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3137,7 +3137,7 @@ static void xhci_doorbell_write(void *ptr, hwaddr reg,
streamid = (val >> 16) & 0xffff;
if (reg > xhci->numslots) {
DPRINTF("xhci: bad doorbell %d\n", (int)reg);
- } else if (epid > 31) {
+ } else if (epid == 0 || epid > 31) {
DPRINTF("xhci: bad doorbell %d write: 0x%x\n",
(int)reg, (uint32_t)val);
} else {
--
2.18.1
- [Qemu-devel] [PULL 0/7] Usb 20190503 v2 patches, Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 1/7] usb-mtp: fix string length for filename when writing metadata, Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 5/7] hw/usb/hcd-ohci: Do not use PCI functions with sysbus devices in ohci_die(), Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 3/7] usb-mtp: change default to success for usb_mtp_update_object, Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 4/7] usb/xhci: avoid trigger assertion if guest write wrong epid,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 7/7] hw/usb: avoid format truncation warning when formatting port name, Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 2/7] usb-mtp: fix alignment of access of ObjectInfo filename field, Gerd Hoffmann, 2019/05/03
- [Qemu-devel] [PULL 6/7] hw/usb/hcd-ohci: Move PCI-related code into a separate file, Gerd Hoffmann, 2019/05/03
- Re: [Qemu-devel] [PULL 0/7] Usb 20190503 v2 patches, Peter Maydell, 2019/05/03