You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Peter Maydell d0af3cd027 hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint ... If the guest feeds invalid data to the UHCI controller, we can assert: qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. (see issue 2548 for the repro case). This happens because the guest attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not valid. The controller code doesn't catch this guest error, so instead we hit the assertion in the USB core code. Catch the case of SETUP to non-zero endpoint, and treat it as a fatal error in the TD, in the same way we do for an invalid PID value in the TD. This is the UHCI equivalent of the same bug in OHCI that we fixed in commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT"). This bug has been tracked as CVE-2024-8354. Cc: qemu-stable@nongnu.org Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>		4 weeks ago
..
Kconfig	Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX	8 months ago
bus-stub.c	include: Rename sysemu/ -> system/	10 months ago
bus.c	qom: Make InterfaceInfo[] uses const	6 months ago
canokey.c	qom: Have class_init() take a const data argument	6 months ago
canokey.h	hw/usb/canokey: Fix buffer overflow for OUT packet	9 months ago
ccid-card-emulated.c	qom: Have class_init() take a const data argument	6 months ago
ccid-card-passthru.c	qom: Have class_init() take a const data argument	6 months ago
ccid.h	Use OBJECT_DECLARE_TYPE when possible	5 years ago
chipidea.c	qom: Have class_init() take a const data argument	6 months ago
combined-packet.c	usb: limit combined packets to 1 MiB (CVE-2021-3527)	5 years ago
core.c	usb: add pcap support.	5 years ago
desc-msos.c	hw/usb: Fix typo in comments and print	4 years ago
desc.c	hw/usb: Silence compiler warnings in USB code when compiling with -Wshadow	2 years ago
desc.h	usb: allow max 8192 bytes for desc	4 years ago
dev-audio.c	qom: Have class_init() take a const data argument	6 months ago
dev-hid.c	hw/usb/dev-hid: Support side and extra mouse buttons for usb-tablet	3 months ago
dev-hub.c	qom: Have class_init() take a const data argument	6 months ago
dev-mtp.c	qom: Have class_init() take a const data argument	6 months ago
dev-network.c	hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response	1 month ago
dev-serial.c	qom: Have class_init() take a const data argument	6 months ago
dev-smartcard-reader.c	qom: Make InterfaceInfo[] uses const	6 months ago
dev-storage-bot.c	qom: Have class_init() take a const data argument	6 months ago
dev-storage-classic.c	qom: Have class_init() take a const data argument	6 months ago
dev-storage.c	qom: Have class_init() take a const data argument	6 months ago
dev-uas.c	qom: Have class_init() take a const data argument	6 months ago
dev-wacom.c	qom: Have class_init() take a const data argument	6 months ago
hcd-dwc2.c	qom: Have class_init() take a const data argument	6 months ago
hcd-dwc2.h	include: Rename sysemu/ -> system/	10 months ago
hcd-dwc3.c	qom: Have class_init() take a const data argument	6 months ago
hcd-ehci-pci.c	qom: Make InterfaceInfo[] uses const	6 months ago
hcd-ehci-sysbus.c	qom: Have class_init() take a const data argument	6 months ago
hcd-ehci.c	hw/usb/hcd-ehci: Fix debug printf format string	9 months ago
hcd-ehci.h	include: Rename sysemu/ -> system/	10 months ago
hcd-ohci-pci.c	qom: Make InterfaceInfo[] uses const	6 months ago
hcd-ohci-sysbus.c	qom: Have class_init() take a const data argument	6 months ago
hcd-ohci.c	hw/usb/hcd-ohci: skip automatic zero-init of large array	4 months ago
hcd-ohci.h	include: Rename sysemu/ -> system/	10 months ago
hcd-uhci.c	hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint	4 weeks ago
hcd-uhci.h	qom: Have class_init() take a const data argument	6 months ago
hcd-xhci-nec.c	qom: Have class_init() take a const data argument	6 months ago
hcd-xhci-pci.c	qom: Make InterfaceInfo[] uses const	6 months ago
hcd-xhci-pci.h	hw/usb/hcd-xhci-pci: Adds property for disabling mapping in IRQ mode	8 months ago
hcd-xhci-sysbus.c	qom: Have class_init() take a const data argument	6 months ago
hcd-xhci-sysbus.h	usb/xhci: add include/hw/usb/xhci.h header file	5 years ago
hcd-xhci.c	hw/usb/hcd-xhci: Unmap canceled packet	6 months ago
hcd-xhci.h	hw/usb/hcd-xhci-pci: Adds property for disabling mapping in IRQ mode	8 months ago
host-libusb.c	qom: Have class_init() take a const data argument	6 months ago
imx-usb-phy.c	qom: Have class_init() take a const data argument	6 months ago
libhw.c	include: Rename sysemu/ -> system/	10 months ago
meson.build	Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX	8 months ago
pcap.c	usb/pcap: set flag_setup	5 years ago
quirks-ftdi-ids.h	hw/usb: Fix typo in comments and print	4 years ago
quirks-pl2303-ids.h	hw/usb: fix tab indentation	3 years ago
quirks.c	hw/usb/quirks: Use smaller types to reduce .rodata by 10KiB	6 years ago
quirks.h	hw/usb: spelling fixes	2 years ago
redirect.c	qom: Have class_init() take a const data argument	6 months ago
trace-events	hw/usb/hcd-ohci: Fix ohci_service_td: accept zero-length TDs where CBP=BE+1	1 year ago
trace.h	trace: switch position of headers to what Meson requires	5 years ago
u2f-emulated.c	qom: Have class_init() take a const data argument	6 months ago
u2f-passthru.c	qom: Have class_init() take a const data argument	6 months ago
u2f.c	qom: Have class_init() take a const data argument	6 months ago
u2f.h	hw/usb/u2f: Declare QOM macros using OBJECT_DECLARE_TYPE()	3 years ago
vt82c686-uhci-pci.c	hw/usb/vt82c686-uhci-pci: Use ISA instead of PCI interrupts	2 years ago
xen-usb.c	hw/xen: Prefer QOM cast for XenLegacyDevice	8 months ago
xlnx-usb-subsystem.c	qom: Have class_init() take a const data argument	6 months ago
xlnx-versal-usb2-ctrl-regs.c	qom: Have class_init() take a const data argument	6 months ago