[Qemu-commits] [qemu/qemu] 49d925: usb: check page select value while processing iTD

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 49d925ce50383a286278143c05511d30ec41a36e
      
https://github.com/qemu/qemu/commit/49d925ce50383a286278143c05511d30ec41a36e
  Author: Prasad J Pandit <address@hidden>
  Date:   2016-02-02 (Tue, 02 Feb 2016)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  usb: check page select value while processing iTD

While processing isochronous transfer descriptors(iTD), the page
select(PG) field value could lead to an OOB read access. Add
check to avoid it.

Reported-by: Qinghao Tang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66
      
https://github.com/qemu/qemu/commit/5a8660741a8aa19fbf8a5e8a2b3aac88664f4e66
  Author: Gerd Hoffmann <address@hidden>
  Date:   2016-02-02 (Tue, 02 Feb 2016)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: update irq on reset

After clearing the status register we also have to update the irq line
status.  Otherwise a irq which happends to be pending at reset time
causes a interrupt storm.  And the guest can't stop as the status
register doesn't indicate any pending interrupt.

Both NetBSD and FreeBSD hang on shutdown because of that.

Cc: address@hidden
Reported-by: Andrey Korolyov <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: 3bb1e822ca7c8b48ac80cb7bd53af94c91c949e7
      
https://github.com/qemu/qemu/commit/3bb1e822ca7c8b48ac80cb7bd53af94c91c949e7
  Author: Peter Maydell <address@hidden>
  Date:   2016-02-02 (Tue, 02 Feb 2016)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20160202-1' into 
staging

usb: two ehci fixes.

# gpg: Signature made Tue 02 Feb 2016 13:12:00 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"

* remotes/kraxel/tags/pull-usb-20160202-1:
  ehci: update irq on reset
  usb: check page select value while processing iTD

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/d2ea854c382d...3bb1e822ca7c