From: Tommaso Califano <[email protected]>
The EP_DATA_IN result path serializes the queued response as a 12
byte MTP container header followed by one 4 byte word per result
argument (12 + 4 * argc bytes). The entry check at the top of the
function only verifies that the guest-provided transfer buffer holds
at least the 12 byte header.
If the queued result carries arguments, e.g. RES_SESSION_ALREADY_OPEN
which returns the existing session ID, the second usb_packet_copy()
writes past the end of the guest-declared buffer and trips the
p->actual_length + bytes <= iov->size assertion, aborting QEMU. A
guest can control the transfer size freely, e.g. TBYTES in the qTD
of an EHCI BULK IN.
A device must not send more data than the initiator signaled it would
accept. Stall the transfer instead, and keep the result queued so that
a subsequent BULK IN with a sufficient buffer size delivers the full
response.
Fixes: 840a178c94db ("usb: mtp filesharing")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3386
Signed-off-by: Tommaso Califano <[email protected]>
Reviewed-by: Junjie Cao <[email protected]>
Reviewed-by: Luigi Leonardi <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
(cherry picked from commit b17205f23a9a8661394d30148b2c995ffa932019)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1ea97bf8b33..190eb6bd1fd 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1908,6 +1908,13 @@ static void usb_mtp_handle_data(USBDevice *dev,
USBPacket *p)
} else if (s->result != NULL) {
MTPControl *r = s->result;
int length = sizeof(container) + r->argc * sizeof(uint32_t);
+
+ if (p->iov.size < length) {
+ trace_usb_mtp_stall(s->dev.addr,
+ "packet too small to send response");
+ p->status = USB_RET_STALL;
+ return;
+ }
if (r->code == RES_OK) {
trace_usb_mtp_success(s->dev.addr, r->trans,
(r->argc > 0) ? r->argv[0] : 0,
--
2.47.3
