hw/usb/hcd-dwc2: fix divide-by-zero in dwc2_handle_packet()
Check the value of mps to avoid potential divide-by-zero later in the function. Since HCCHAR_MPS is guest controllable, this prevents a malicious/buggy guest from crashing the QEMU process on the host. Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> Reported-by: Gaoning Pan <gaoning.pgn@antgroup.com> Reported-by: Xingwei Lin <linyi.lxw@antfin.com> Message-id: 20201015075957.268823-1-mcascell@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
ccee80c68d
commit
bea2a9e3e0
@ -250,6 +250,12 @@ static void dwc2_handle_packet(DWC2State *s, uint32_t devadr, USBDevice *dev,
|
||||
trace_usb_dwc2_handle_packet(chan, dev, &p->packet, epnum, types[eptype],
|
||||
dirs[epdir], mps, len, pcnt);
|
||||
|
||||
if (mps == 0) {
|
||||
qemu_log_mask(LOG_GUEST_ERROR,
|
||||
"%s: Bad HCCHAR_MPS set to zero\n", __func__);
|
||||
return;
|
||||
}
|
||||
|
||||
if (eptype == USB_ENDPOINT_XFER_CONTROL && pid == TSIZ_SC_MC_PID_SETUP) {
|
||||
pid = USB_TOKEN_SETUP;
|
||||
} else {
|
||||
|
Loading…
Reference in New Issue
Block a user