diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2020-10-15 09:59:57 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-10-19 09:17:21 +0200 |
| commit | bea2a9e3e00b275dc40cfa09c760c715b8753e03 (patch) | |
| tree | 8dc1d99ffbc615c58121e422866cbdccc2a8ac41 /hw/usb | |
| parent | ccee80c68db14b3e965582a19393992b5c2b97f4 (diff) | |
hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()
Check the value of mps to avoid potential divide-by-zero later in the function.
Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest
from crashing the QEMU process on the host.
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Paul Zimmerman <pauldzim@gmail.com>
Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com>
Reported-by: Xingwei Lin <linyi.lxw@antfin.com>
Message-id: 20201015075957.268823-1-mcascell@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb')
| -rw-r--r-- | hw/usb/hcd-dwc2.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/usb/hcd-dwc2.c b/hw/usb/hcd-dwc2.c index 64c23c1ed0..e1d96acf7e 100644 --- a/hw/usb/hcd-dwc2.c +++ b/hw/usb/hcd-dwc2.c @@ -250,6 +250,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev, trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype], dirs[epdir], mps, len, pcnt); + if (mps == 0) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: Bad HCCHAR_MPS set to zero\n", __func__); + return; + } + if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) { pid = USB_TOKEN_SETUP; } else { |