diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2025-09-15 14:29:10 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2025-09-25 11:06:27 +0100 |
| commit | d0af3cd0274e265435170a583c72b9f0a4100dff (patch) | |
| tree | 8208550139659f09ac61ffc06950496939fb6c30 /hw/intc/grlib_irqmp.c | |
| parent | 95b9e0d2ade5d633fd13ffba96a54e87c65baf39 (diff) | |
| download | focaccia-qemu-d0af3cd0274e265435170a583c72b9f0a4100dff.tar.gz focaccia-qemu-d0af3cd0274e265435170a583c72b9f0a4100dff.zip | |
hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint
If the guest feeds invalid data to the UHCI controller, we
can assert:
qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
(see issue 2548 for the repro case). This happens because the guest
attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not
valid. The controller code doesn't catch this guest error, so
instead we hit the assertion in the USB core code.
Catch the case of SETUP to non-zero endpoint, and treat it as a fatal
error in the TD, in the same way we do for an invalid PID value in
the TD.
This is the UHCI equivalent of the same bug in OHCI that we fixed in
commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or
OUT").
This bug has been tracked as CVE-2024-8354.
Cc: qemu-stable@nongnu.org
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'hw/intc/grlib_irqmp.c')
0 files changed, 0 insertions, 0 deletions