From 8cdc56d74200b4bfa9aeec6b162432761a3535bf Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 23 Jun 2011 12:41:35 -0300
Subject: [RHEL6 qemu-kvm PATCH 060/115] usb-linux: Refuse packets for endpoints which are not in the usb descriptor

RH-Author: Gerd Hoffmann <kraxel@redhat.com>
Message-id: <1308832951-8995-60-git-send-email-kraxel@redhat.com>
Patchwork-id: 28384
O-Subject: [RHEL-6.2 kvm PATCH 059/115] usb-linux: Refuse packets for endpoints which are not in the usb descriptor
Bugzilla: 561414 632299 645351 711354
RH-Acked-by: Hans de Goede <hdegoede@redhat.com>
RH-Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>

From: Hans de Goede <hdegoede@redhat.com>

If an endpoint is not in the usb descriptor we've no idea what kind of
endpoint it is and thus how to handle it, refuse packages in this case.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
(cherry picked from commit a0b5fece8afe7deca08cbca97e2a4015d7f0038e)
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 usb-linux.c |   13 +++++++++++++
 1 files changed, 13 insertions(+), 0 deletions(-)

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 usb-linux.c |   13 +++++++++++++
 1 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/usb-linux.c b/usb-linux.c
index a5fe6c1..d3a56f6 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -94,6 +94,7 @@ static int usb_fs_type;
 /* endpoint association data */
 #define ISO_FRAME_DESC_PER_URB 32
 #define ISO_URB_COUNT 3
+#define INVALID_EP_TYPE 255
 
 typedef struct AsyncURB AsyncURB;
 
@@ -168,6 +169,11 @@ static int is_isoc(USBHostDevice *s, int ep)
     return s->endp_table[ep - 1].type == USBDEVFS_URB_TYPE_ISO;
 }
 
+static int is_valid(USBHostDevice *s, int ep)
+{
+    return s->endp_table[ep - 1].type != INVALID_EP_TYPE;
+}
+
 static int is_halted(USBHostDevice *s, int ep)
 {
     return s->endp_table[ep - 1].halted;
@@ -607,6 +613,10 @@ static int usb_host_handle_data(USBHostDevice *s, USBPacket *p)
     int ret;
     uint8_t ep;
 
+    if (!is_valid(s, p->devep)) {
+        return USB_RET_NAK;
+    }
+
     if (p->pid == USB_TOKEN_IN) {
         ep = p->devep | 0x80;
     } else {
@@ -1053,6 +1063,9 @@ static int usb_linux_update_endp_table(USBHostDevice *s)
     uint8_t devep, type, configuration, alt_interface;
     int interface, length, i;
 
+    for (i = 0; i < MAX_ENDPOINTS; i++)
+        s->endp_table[i].type = INVALID_EP_TYPE;
+
     i = usb_linux_get_configuration(s);
     if (i < 0)
         return 1;
-- 
1.7.3.2