Re: [Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-14 Thread Gerd Hoffmann
On Mo, 2015-12-14 at 16:16 +0530, P J P wrote: > +-- On Mon, 14 Dec 2015, Gerd Hoffmann wrote --+ > | Good. Is there a cve number for that one which I can add to the commit > | message? > > No, not yet. I'll request one, once it is approved for the upstream. Ok, sending out for review without

Re: [Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-14 Thread P J P
+-- On Mon, 14 Dec 2015, Gerd Hoffmann wrote --+ | Good. Is there a cve number for that one which I can add to the commit | message? No, not yet. I'll request one, once it is approved for the upstream. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053

Re: [Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-14 Thread Gerd Hoffmann
On Mo, 2015-12-14 at 15:33 +0530, P J P wrote: > Hello Gerd, > > +-- On Mon, 14 Dec 2015, Gerd Hoffmann wrote --+ > | Can you test the attached patch please? In case it doesn't fix the bug: > > Yes, it did fix the infinite loop issue. Good. Is there a cve number for that one which I can ad

Re: [Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-14 Thread P J P
Hello Gerd, +-- On Mon, 14 Dec 2015, Gerd Hoffmann wrote --+ | Can you test the attached patch please? In case it doesn't fix the bug: Yes, it did fix the infinite loop issue. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Re: [Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-14 Thread Gerd Hoffmann
On Do, 2015-12-10 at 18:51 +0530, P J P wrote: >Hello Gerd, > > An infinite loop issue was reported by Mr Qinghao Tang(CC'd), in the USB EHCI > emulator. In that, a malicious isochronous transfer descriptor(iTD) list > could > unfold an infinite loop in the 'ehci_advance_state' routine, by

[Qemu-devel] [PATCH] usb: hcd-ehci: add check to avoid an infinite loop

2015-12-10 Thread P J P
Hello Gerd, An infinite loop issue was reported by Mr Qinghao Tang(CC'd), in the USB EHCI emulator. In that, a malicious isochronous transfer descriptor(iTD) list could unfold an infinite loop in the 'ehci_advance_state' routine, by always setting 'again = 0 or 1'. Please see below a propo