diff options
| author | Peter Maydell | 2021-05-10 20:55:06 +0200 |
|---|---|---|
| committer | Peter Maydell | 2021-05-10 20:55:06 +0200 |
| commit | e4f3ede95ce813d5705c65e1c0e1c80c70739ebb (patch) | |
| tree | 016c7cd9d083ce5ac4304ba6d09c99cbd4c9214f /hw/usb/combined-packet.c | |
| parent | Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210510-... (diff) | |
| parent | usb: limit combined packets to 1 MiB (CVE-2021-3527) (diff) | |
| download | qemu-e4f3ede95ce813d5705c65e1c0e1c80c70739ebb.tar.gz qemu-e4f3ede95ce813d5705c65e1c0e1c80c70739ebb.tar.xz qemu-e4f3ede95ce813d5705c65e1c0e1c80c70739ebb.zip | |
Merge remote-tracking branch 'remotes/kraxel/tags/usb-20210505-pull-request' into staging
usb: fix some memory allocation issues (CVE-2021-3527).
usb: add stubs, allow building without usb subsystem.
# gpg: Signature made Wed 05 May 2021 14:07:02 BST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/usb-20210505-pull-request:
usb: limit combined packets to 1 MiB (CVE-2021-3527)
usb/mtp: avoid dynamic stack allocation
usb/redir: avoid dynamic stack allocation (CVE-2021-3527)
usb/hid: avoid dynamic stack allocation
hw/usb: Do not build USB subsystem if not required
hw/usb/host-stub: Remove unused header
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/usb/combined-packet.c')
| -rw-r--r-- | hw/usb/combined-packet.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/usb/combined-packet.c b/hw/usb/combined-packet.c index 5d57e883dc..e56802f89a 100644 --- a/hw/usb/combined-packet.c +++ b/hw/usb/combined-packet.c @@ -171,7 +171,9 @@ void usb_ep_combine_input_packets(USBEndpoint *ep) if ((p->iov.size % ep->max_packet_size) != 0 || !p->short_not_ok || next == NULL || /* Work around for Linux usbfs bulk splitting + migration */ - (totalsize == (16 * KiB - 36) && p->int_req)) { + (totalsize == (16 * KiB - 36) && p->int_req) || + /* Next package may grow combined package over 1MiB */ + totalsize > 1 * MiB - ep->max_packet_size) { usb_device_handle_data(ep->dev, first); assert(first->status == USB_RET_ASYNC); if (first->combined) { |