[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2] hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [PATCH v2] hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet() |
Date: |
Thu, 15 Oct 2020 13:02:04 +0200 |
On Thu, Oct 15, 2020 at 10:03 AM Mauro Matteo Cascella
<mcascell@redhat.com> wrote:
>
> Check the value of mps to avoid potential divide-by-zero later in the
> function.
> Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest
> from crashing the QEMU process on the host.
>
> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>
> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>
> Reported-by: Xingwei Lin <linyi.lxw@antfin.com>
Maybe also the implicit
Tested-by: Paul Zimmerman <pauldzim@gmail.com>
from:
https://lists.gnu.org/archive/html/qemu-devel/2020-10/msg04254.html
> ---
> Moved check earlier in the function and added "Reviewed-by" line.
>
> hw/usb/hcd-dwc2.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c
> index 97688d21bf..9856c4540c 100644
> --- a/hw/usb/hcd-dwc2.c
> +++ b/hw/usb/hcd-dwc2.c
> @@ -245,6 +245,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t
> devadr, USBDevice *dev,
> trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype],
> dirs[epdir], mps, len, pcnt);
>
> + if (mps == 0) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: Bad HCCHAR_MPS set to zero\n", __func__);
> + return;
> + }
> +
> if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) {
> pid = USB_TOKEN_SETUP;
> } else {
> --
> 2.26.2
>
>