80 lines
2.4 KiB
Diff
80 lines
2.4 KiB
Diff
|
From a7c87c869ac75a076fa5552f9604f73f710cff80 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Jim Paris <jim@jtan.com>
|
||
|
|
Date: Mon, 24 Aug 2009 14:56:12 -0400
|
||
|
|
Subject: [PATCH] usb-linux.c: fix buffer overflow
|
||
|
|
|
||
|
|
In usb-linux.c:usb_host_handle_control, we pass a 1024-byte buffer and
|
||
|
|
length to the kernel. However, the length was provided by the caller
|
||
|
|
of dev->handle_packet, and is not checked, so the kernel might provide
|
||
|
|
too much data and overflow our buffer.
|
||
|
|
|
||
|
|
For example, hw/usb-uhci.c could set the length to 2047.
|
||
|
|
hw/usb-ohci.c looks like it might go up to 4096 or 8192.
|
||
|
|
|
||
|
|
This causes a qemu crash, as reported here:
|
||
|
|
http://www.mail-archive.com/kvm@vger.kernel.org/msg18447.html
|
||
|
|
|
||
|
|
This patch increases the usb-linux.c buffer size to 2048 to fix the
|
||
|
|
specific device reported, and adds a check to avoid the overflow in
|
||
|
|
any case.
|
||
|
|
|
||
|
|
Signed-off-by: Jim Paris <jim@jtan.com>
|
||
|
|
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
||
|
|
|
||
|
|
The WLAN USB stick ZyXEL NWD271N (0586:3417) uses very large
|
||
|
|
usb control transfers of more than 2048 bytes. Increasing the
|
||
|
|
buffer size to 8192.
|
||
|
|
|
||
|
|
Signed-off-by: Christian Krause <chkr@plauener.de>
|
||
|
|
---
|
||
|
|
usb-linux.c | 12 ++++++++++--
|
||
|
|
1 files changed, 10 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/usb-linux.c b/usb-linux.c
|
||
|
|
index f19f0c4..298f342 100644
|
||
|
|
--- a/usb-linux.c
|
||
|
|
+++ b/usb-linux.c
|
||
|
|
@@ -115,7 +115,7 @@ struct ctrl_struct {
|
||
|
|
uint16_t offset;
|
||
|
|
uint8_t state;
|
||
|
|
struct usb_ctrlrequest req;
|
||
|
|
- uint8_t buffer[1024];
|
||
|
|
+ uint8_t buffer[8192];
|
||
|
|
};
|
||
|
|
|
||
|
|
typedef struct USBHostDevice {
|
||
|
|
@@ -552,6 +552,7 @@ static int usb_host_handle_control(USBHostDevice *s, USBPacket *p)
|
||
|
|
struct usbdevfs_urb *urb;
|
||
|
|
AsyncURB *aurb;
|
||
|
|
int ret, value, index;
|
||
|
|
+ int buffer_len;
|
||
|
|
|
||
|
|
/*
|
||
|
|
* Process certain standard device requests.
|
||
|
|
@@ -580,6 +581,13 @@ static int usb_host_handle_control(USBHostDevice *s, USBPacket *p)
|
||
|
|
|
||
|
|
/* The rest are asynchronous */
|
||
|
|
|
||
|
|
+ buffer_len = 8 + s->ctrl.len;
|
||
|
|
+ if (buffer_len > sizeof(s->ctrl.buffer)) {
|
||
|
|
+ fprintf(stderr, "husb: ctrl buffer too small (%u > %lu)\n",
|
||
|
|
+ buffer_len, sizeof(s->ctrl.buffer));
|
||
|
|
+ return USB_RET_STALL;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
aurb = async_alloc();
|
||
|
|
aurb->hdev = s;
|
||
|
|
aurb->packet = p;
|
||
|
|
@@ -596,7 +604,7 @@ static int usb_host_handle_control(USBHostDevice *s, USBPacket *p)
|
||
|
|
urb->endpoint = p->devep;
|
||
|
|
|
||
|
|
urb->buffer = &s->ctrl.req;
|
||
|
|
- urb->buffer_length = 8 + s->ctrl.len;
|
||
|
|
+ urb->buffer_length = buffer_len;
|
||
|
|
|
||
|
|
urb->usercontext = s;
|
||
|
|
|
||
|
|
--
|
||
|
|
1.6.2.5
|
||
|
|
|