From 8cdc56d74200b4bfa9aeec6b162432761a3535bf Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 23 Jun 2011 12:41:35 -0300
Subject: [RHEL6 qemu-kvm PATCH 060/115] usb-linux: Refuse packets for endpoints which are not in the usb descriptor
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
Message-id: <1308832951-8995-60-git-send-email-kraxel@redhat.com>
Patchwork-id: 28384
O-Subject: [RHEL-6.2 kvm PATCH 059/115] usb-linux: Refuse packets for endpoints which are not in the usb descriptor
Bugzilla: 561414 632299 645351 711354
RH-Acked-by: Hans de Goede <hdegoede@redhat.com>
RH-Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
From: Hans de Goede <hdegoede@redhat.com>
If an endpoint is not in the usb descriptor we've no idea what kind of
endpoint it is and thus how to handle it, refuse packages in this case.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
(cherry picked from commit a0b5fece8afe7deca08cbca97e2a4015d7f0038e)
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
usb-linux.c | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
usb-linux.c | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/usb-linux.c b/usb-linux.c
index a5fe6c1..d3a56f6 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -94,6 +94,7 @@ static int usb_fs_type;
/* endpoint association data */
#define ISO_FRAME_DESC_PER_URB 32
#define ISO_URB_COUNT 3
+#define INVALID_EP_TYPE 255
typedef struct AsyncURB AsyncURB;
@@ -168,6 +169,11 @@ static int is_isoc(USBHostDevice *s, int ep)
return s->endp_table[ep - 1].type == USBDEVFS_URB_TYPE_ISO;
}
+static int is_valid(USBHostDevice *s, int ep)
+{
+ return s->endp_table[ep - 1].type != INVALID_EP_TYPE;
+}
+
static int is_halted(USBHostDevice *s, int ep)
{
return s->endp_table[ep - 1].halted;
@@ -607,6 +613,10 @@ static int usb_host_handle_data(USBHostDevice *s, USBPacket *p)
int ret;
uint8_t ep;
+ if (!is_valid(s, p->devep)) {
+ return USB_RET_NAK;
+ }
+
if (p->pid == USB_TOKEN_IN) {
ep = p->devep | 0x80;
} else {
@@ -1053,6 +1063,9 @@ static int usb_linux_update_endp_table(USBHostDevice *s)
uint8_t devep, type, configuration, alt_interface;
int interface, length, i;
+ for (i = 0; i < MAX_ENDPOINTS; i++)
+ s->endp_table[i].type = INVALID_EP_TYPE;
+
i = usb_linux_get_configuration(s);
if (i < 0)
return 1;
--
1.7.3.2