yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
958e1b
From 0ebce8809c6cf12e4df5fe9fdf441b280176412e Mon Sep 17 00:00:00 2001
958e1b
From: Gerd Hoffmann <kraxel@redhat.com>
958e1b
Date: Tue, 18 Nov 2014 11:42:20 +0100
958e1b
Subject: [PATCH 1/5] xhci: add sanity checks to xhci_lookup_uport
958e1b
958e1b
Message-id: <1416310940-10391-2-git-send-email-kraxel@redhat.com>
958e1b
Patchwork-id: 62418
958e1b
O-Subject: [RHEL-7.1 qemu-kvm PATCH v2 1/1] xhci: add sanity checks to xhci_lookup_uport
958e1b
Bugzilla: 1074219
958e1b
RH-Acked-by: Dr. David Alan Gilbert (git) <dgilbert@redhat.com>
958e1b
RH-Acked-by: Marcel Apfelbaum <marcel.a@redhat.com>
958e1b
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
958e1b
958e1b
Also catch xhci_lookup_uport failures in post_load.
958e1b
958e1b
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
958e1b
(cherry picked from commit f2ad97ff81da51c064b9e87720ff48a0874f45d4)
958e1b
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
958e1b
---
958e1b
 hw/usb/hcd-xhci.c | 9 +++++++++
958e1b
 1 file changed, 9 insertions(+)
958e1b
958e1b
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
958e1b
index 32568cb..ce81632 100644
958e1b
--- a/hw/usb/hcd-xhci.c
958e1b
+++ b/hw/usb/hcd-xhci.c
958e1b
@@ -2254,6 +2254,9 @@ static USBPort *xhci_lookup_uport(XHCIState *xhci, uint32_t *slot_ctx)
958e1b
     int i, pos, port;
958e1b
 
958e1b
     port = (slot_ctx[1]>>16) & 0xFF;
958e1b
+    if (port < 1 || port > xhci->numports) {
958e1b
+        return NULL;
958e1b
+    }
958e1b
     port = xhci->ports[port-1].uport->index+1;
958e1b
     pos = snprintf(path, sizeof(path), "%d", port);
958e1b
     for (i = 0; i < 5; i++) {
958e1b
@@ -3637,6 +3640,12 @@ static int usb_xhci_post_load(void *opaque, int version_id)
958e1b
             xhci_mask64(ldq_le_pci_dma(pci_dev, dcbaap + 8 * slotid));
958e1b
         xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
958e1b
         slot->uport = xhci_lookup_uport(xhci, slot_ctx);
958e1b
+        if (!slot->uport) {
958e1b
+            /* should not happen, but may trigger on guest bugs */
958e1b
+            slot->enabled = 0;
958e1b
+            slot->addressed = 0;
958e1b
+            continue;
958e1b
+        }
958e1b
         assert(slot->uport && slot->uport->dev);
958e1b
 
958e1b
         for (epid = 1; epid <= 31; epid++) {
958e1b
-- 
958e1b
1.8.3.1
958e1b