95d1280885
dereference in vapic_write() CVE-2016-1922-qemuu-i386-null-pointer-dereference-in-vapic_write.patch CVE-2016-2391-qemut-usb-null-pointer-dereference-in-ohci-module.patch - bsc#965112 - VUL-0: CVE-2014-3640: xen: slirp: NULL pointer deref in sosendto() CVE-2014-3640-qemut-slirp-NULL-pointer-deref-in-sosendto.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=404
91 lines
2.6 KiB
Diff
91 lines
2.6 KiB
Diff
References: bsc#967101 CVE-2016-2391
|
|
|
|
From d1b07becc481e09225cfe905ec357807ae07f095 Mon Sep 17 00:00:00 2001
|
|
From: Gerd Hoffmann <address@hidden>
|
|
Date: Tue, 16 Feb 2016 15:15:04 +0100
|
|
Subject: [PATCH] ohci timer fix
|
|
|
|
Signed-off-by: Gerd Hoffmann <address@hidden>
|
|
---
|
|
hw/usb/hcd-ohci.c | 31 +++++--------------------------
|
|
1 file changed, 5 insertions(+), 26 deletions(-)
|
|
|
|
Index: xen-4.6.1-testing/tools/qemu-xen-dir-remote/hw/usb/hcd-ohci.c
|
|
===================================================================
|
|
--- xen-4.6.1-testing.orig/tools/qemu-xen-dir-remote/hw/usb/hcd-ohci.c
|
|
+++ xen-4.6.1-testing/tools/qemu-xen-dir-remote/hw/usb/hcd-ohci.c
|
|
@@ -1331,16 +1331,6 @@ static void ohci_frame_boundary(void *op
|
|
*/
|
|
static int ohci_bus_start(OHCIState *ohci)
|
|
{
|
|
- ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
|
|
- ohci_frame_boundary,
|
|
- ohci);
|
|
-
|
|
- if (ohci->eof_timer == NULL) {
|
|
- trace_usb_ohci_bus_eof_timer_failed(ohci->name);
|
|
- ohci_die(ohci);
|
|
- return 0;
|
|
- }
|
|
-
|
|
trace_usb_ohci_start(ohci->name);
|
|
|
|
ohci_sof(ohci);
|
|
@@ -1352,11 +1342,7 @@ static int ohci_bus_start(OHCIState *ohc
|
|
static void ohci_bus_stop(OHCIState *ohci)
|
|
{
|
|
trace_usb_ohci_stop(ohci->name);
|
|
- if (ohci->eof_timer) {
|
|
- timer_del(ohci->eof_timer);
|
|
- timer_free(ohci->eof_timer);
|
|
- }
|
|
- ohci->eof_timer = NULL;
|
|
+ timer_del(ohci->eof_timer);
|
|
}
|
|
|
|
/* Sets a flag in a port status register but only set it if the port is
|
|
@@ -1881,6 +1867,8 @@ static int usb_ohci_init(OHCIState *ohci
|
|
ohci->async_td = 0;
|
|
qemu_register_reset(ohci_reset, ohci);
|
|
|
|
+ ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
|
|
+ ohci_frame_boundary, ohci);
|
|
return 0;
|
|
}
|
|
|
|
@@ -1949,6 +1937,9 @@ static void usb_ohci_exit(PCIDevice *dev
|
|
if (!ohci->masterbus) {
|
|
usb_bus_release(&s->bus);
|
|
}
|
|
+
|
|
+ timer_del(s->eof_timer);
|
|
+ timer_free(s->eof_timer);
|
|
}
|
|
|
|
#define TYPE_SYSBUS_OHCI "sysbus-ohci"
|
|
@@ -1997,23 +1988,13 @@ static bool ohci_eof_timer_needed(void *
|
|
{
|
|
OHCIState *ohci = opaque;
|
|
|
|
- return ohci->eof_timer != NULL;
|
|
-}
|
|
-
|
|
-static int ohci_eof_timer_pre_load(void *opaque)
|
|
-{
|
|
- OHCIState *ohci = opaque;
|
|
-
|
|
- ohci_bus_start(ohci);
|
|
-
|
|
- return 0;
|
|
+ return timer_pending(ohci->eof_timer);
|
|
}
|
|
|
|
static const VMStateDescription vmstate_ohci_eof_timer = {
|
|
.name = "ohci-core/eof-timer",
|
|
.version_id = 1,
|
|
.minimum_version_id = 1,
|
|
- .pre_load = ohci_eof_timer_pre_load,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_TIMER(eof_timer, OHCIState),
|
|
VMSTATE_END_OF_LIST()
|