e0a4eb7219
CVE-2016-3712: out of bounds read in vga (bz #1334342) Fix USB redirection (bz #1330221) CVE-2016-4037: infinite loop in usb ehci (bz #1328080) CVE-2016-4001: buffer overflow in stellaris net (bz #1325885) CVE-2016-2858: rng stack corruption (bz #1314677) CVE-2016-2391: ohci: crash via multiple timers (bz #1308881) CVE-2016-2198: ehci: null pointer dereference (bz #1303134) Fix tpm passthrough (bz #1281413) Fix ./configure with ccache Ship sysctl file to fix s390x kvm (bz #1290589)
97 lines
2.8 KiB
Diff
97 lines
2.8 KiB
Diff
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
Date: Mon, 22 Feb 2016 09:50:11 +0100
|
|
Subject: [PATCH] ohci: allocate timer only once.
|
|
|
|
Allocate timer once, at init time, instead of allocating/freeing
|
|
it all the time when starting/stopping the bus. Simplifies the
|
|
code, also fixes bugs (memory leak) due to missing checks whenever
|
|
the time is already allocated or not.
|
|
|
|
Cc: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
(cherry picked from commit fa1298c2d623522eda7b4f1f721fcb935abb7360)
|
|
---
|
|
hw/usb/hcd-ohci.c | 34 ++++++++--------------------------
|
|
1 file changed, 8 insertions(+), 26 deletions(-)
|
|
|
|
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
|
|
index 7d65818..9936a35 100644
|
|
--- a/hw/usb/hcd-ohci.c
|
|
+++ b/hw/usb/hcd-ohci.c
|
|
@@ -1331,16 +1331,6 @@ static void ohci_frame_boundary(void *opaque)
|
|
*/
|
|
static int ohci_bus_start(OHCIState *ohci)
|
|
{
|
|
- ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
|
|
- ohci_frame_boundary,
|
|
- ohci);
|
|
-
|
|
- if (ohci->eof_timer == NULL) {
|
|
- trace_usb_ohci_bus_eof_timer_failed(ohci->name);
|
|
- ohci_die(ohci);
|
|
- return 0;
|
|
- }
|
|
-
|
|
trace_usb_ohci_start(ohci->name);
|
|
|
|
ohci_sof(ohci);
|
|
@@ -1352,11 +1342,7 @@ static int ohci_bus_start(OHCIState *ohci)
|
|
static void ohci_bus_stop(OHCIState *ohci)
|
|
{
|
|
trace_usb_ohci_stop(ohci->name);
|
|
- if (ohci->eof_timer) {
|
|
- timer_del(ohci->eof_timer);
|
|
- timer_free(ohci->eof_timer);
|
|
- }
|
|
- ohci->eof_timer = NULL;
|
|
+ timer_del(ohci->eof_timer);
|
|
}
|
|
|
|
/* Sets a flag in a port status register but only set it if the port is
|
|
@@ -1883,6 +1869,9 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState *dev,
|
|
usb_packet_init(&ohci->usb_packet);
|
|
|
|
ohci->async_td = 0;
|
|
+
|
|
+ ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
|
|
+ ohci_frame_boundary, ohci);
|
|
}
|
|
|
|
#define TYPE_PCI_OHCI "pci-ohci"
|
|
@@ -1952,6 +1941,9 @@ static void usb_ohci_exit(PCIDevice *dev)
|
|
if (!ohci->masterbus) {
|
|
usb_bus_release(&s->bus);
|
|
}
|
|
+
|
|
+ timer_del(s->eof_timer);
|
|
+ timer_free(s->eof_timer);
|
|
}
|
|
|
|
static void usb_ohci_reset_pci(DeviceState *d)
|
|
@@ -2017,23 +2009,13 @@ static bool ohci_eof_timer_needed(void *opaque)
|
|
{
|
|
OHCIState *ohci = opaque;
|
|
|
|
- return ohci->eof_timer != NULL;
|
|
-}
|
|
-
|
|
-static int ohci_eof_timer_pre_load(void *opaque)
|
|
-{
|
|
- OHCIState *ohci = opaque;
|
|
-
|
|
- ohci_bus_start(ohci);
|
|
-
|
|
- return 0;
|
|
+ return timer_pending(ohci->eof_timer);
|
|
}
|
|
|
|
static const VMStateDescription vmstate_ohci_eof_timer = {
|
|
.name = "ohci-core/eof-timer",
|
|
.version_id = 1,
|
|
.minimum_version_id = 1,
|
|
- .pre_load = ohci_eof_timer_pre_load,
|
|
.needed = ohci_eof_timer_needed,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_TIMER_PTR(eof_timer, OHCIState),
|