[Bug 246964] bhyve usb_mouse SIGSEGV on null pointer dereference
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Fri Jun 26 08:21:34 UTC 2020
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246964
--- Comment #8 from commit-hook at freebsd.org ---
A commit references this bug:
Author: grehan
Date: Fri Jun 26 08:20:39 UTC 2020
New revision: 362644
URL: https://svnweb.freebsd.org/changeset/base/362644
Log:
Prevent calling USB backends multiple times.
The TRB processing loop could potentially call a back-end twice
with the same status transaction. While this was generally benign,
some code paths in the tablet backend weren't set up to handle
this case, resulting in a NULL dereference.
Fix by
- returning a STALL error when an invalid request was seen in the backend
- skipping a call to the backend if the number of packets in a status
transaction was zero (this code fragment was taken from the Intel ACRN
xhci backend)
PR: 246964
Reported by: Ali Abdallah
Discussed with: Leon Dang (author)
Reviewed by: jhb (#bhyve), Leon Dang
Approved by: jhb
Obtained from: Intel ACRN (partially)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D25228
Changes:
head/usr.sbin/bhyve/pci_xhci.c
head/usr.sbin/bhyve/usb_mouse.c
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-virtualization
mailing list