github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-06-25 15:02:13 +00:00
Code Issues Projects Releases Wiki Activity

DM USB: Fix potential crash issues.

Browse Source 
This patch fix some potential crash issues, like wild
pointers access, buffer overflow and etc.

Change-Id: Iddd8e1820da426adc6b9b4d9da9e44017d9f365c
Signed-off-by: Xiaoguang Wu <xiaoguang.wu@intel.com>
Reviewed-by: Yu Wang <yu1.wang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This commit is contained in:
Xiaoguang Wu 2018-06-04 09:59:40 +08:00 committed by lijinxia
parent e3346754e1
commit c34360b6b8
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
devicemodel/hw/pci/xhci.c
View File

@ -748,7 +748,8 @@ pci_xhci_dev_destroy(struct pci_xhci_dev_emu *de)
if (ue->ue_deinit) if (ue->ue_deinit)
ue->ue_deinit(ud); ue->ue_deinit(ud);
} }
} } else
return;
if (ue->ue_devtype == USB_DEV_PORT_MAPPER) if (ue->ue_devtype == USB_DEV_PORT_MAPPER)
free(ue); free(ue);
@ -3314,7 +3315,8 @@ pci_xhci_parse_bus_port(struct pci_xhci_vdev *xdev, char *opts)
/* 'bus-port' format */ /* 'bus-port' format */
cnt = sscanf(opts, "%u-%u", &bus, &port); cnt = sscanf(opts, "%u-%u", &bus, &port);
if (cnt == EOF || cnt < 2) { if (cnt == EOF || cnt < 2 || bus >= USB_NATIVE_NUM_BUS ||
port >= USB_NATIVE_NUM_PORT) {
rc = -1; rc = -1;
goto errout; goto errout;
} }
@ -3534,7 +3536,10 @@ errout:
xdev->portregs = NULL; xdev->portregs = NULL;
} }
UPRINTF(LFTL, "fail to parse xHCI options, rc=%d\r\n", rc); UPRINTF(LFTL, "fail to parse xHCI options, rc=%d\r\n", rc);
pci_xhci_device_usage(opts);
if (opts)
pci_xhci_device_usage(opts);
return rc; return rc;
} }

6
devicemodel/hw/platform/usb_pmapper.c
View File

@ -149,7 +149,7 @@ usb_dev_prepare_xfer(struct usb_data_xfer *xfer, int *count, int *size)
found = 0; found = 0;
first = -1; first = -1;
c = s = 0; c = s = 0;
if (!count || !size) if (!count || !size || idx < 0 || idx >= USB_MAX_XFER_BLOCKS)
return -1; return -1;
for (i = 0; i < xfer->ndata; i++) { for (i = 0; i < xfer->ndata; i++) {
@ -452,6 +452,10 @@ usb_dev_prepare_ctrl_xfer(struct usb_data_xfer *xfer)
struct usb_data_xfer_block *blk = NULL; struct usb_data_xfer_block *blk = NULL;
idx = xfer->head; idx = xfer->head;
if (idx < 0 || idx >= USB_MAX_XFER_BLOCKS)
return NULL;
for (i = 0; i < xfer->ndata; i++) { for (i = 0; i < xfer->ndata; i++) {
/* /*
* find out the data block and set every * find out the data block and set every