File 0267-usb-ohci-fix-error-return-code-in-s.patch of Package qemu.7444

Overview Repositories Revisions Requests Users Attributes Meta

File 0267-usb-ohci-fix-error-return-code-in-s.patch of Package qemu.7444

From 547101ec382d53c3aebd36eb8095c3d1e6a606c1 Mon Sep 17 00:00:00 2001
From: Li Qiang <liqiang6-s@360.cn>
Date: Tue, 7 Feb 2017 03:15:03 -0800
Subject: [PATCH] usb: ohci: fix error return code in servicing iso td

It should return 1 if an error occurs when reading iso td.
This will avoid an infinite loop issue in ohci_service_ed_list.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Message-id: 5899ac3e.1033240a.944d5.9a2d@mx.google.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 26f670a244982335cc08943fb1ec099a2c81e42d)
[BR: BSC#1042159 CVE-2017-9330]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/usb/hcd-ohci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index c454f124e8..e58396b9ca 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -715,7 +715,7 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
     if (ohci_read_iso_td(ohci, addr, &iso_td)) {
         trace_usb_ohci_iso_td_read_failed(addr);
         ohci_die(ohci);
-        return 0;
+        return 1;
     }
 
     starting_frame = OHCI_BM(iso_td.flags, TD_SF);

Places

File 0267-usb-ohci-fix-error-return-code-in-s.patch of Package qemu.7444

Places