[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-virtualization
Subject:    [Bug 246964] bhyve usb_mouse SIGSEGV on null pointer dereference
From:       bugzilla-noreply () freebsd ! org
Date:       2020-06-26 8:21:34
Message-ID: bug-246964-27103-abaAn1p2V7 () https ! bugs ! freebsd ! org/bugzilla/
[Download RAW message or body]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246964

--- Comment #8 from commit-hook@freebsd.org ---
A commit references this bug:

Author: grehan
Date: Fri Jun 26 08:20:39 UTC 2020
New revision: 362644
URL: https://svnweb.freebsd.org/changeset/base/362644

Log:
  Prevent calling USB backends multiple times.

  The TRB processing loop could potentially call a back-end twice
  with the same status transaction. While this was generally benign,
  some code paths in the tablet backend weren't set up to handle
  this case, resulting in a NULL dereference.

  Fix by
   - returning a STALL error when an invalid request was seen in the backend
   - skipping a call to the backend if the number of packets in a status
     transaction was zero (this code fragment was taken from the Intel ACRN
     xhci backend)

  PR:   246964
  Reported by:  Ali Abdallah
  Discussed with: Leon Dang (author)
  Reviewed by: jhb (#bhyve), Leon Dang
  Approved by: jhb
  Obtained from:  Intel ACRN (partially)
  MFC after: 2 weeks
  Differential Revision:        https://reviews.freebsd.org/D25228

Changes:
  head/usr.sbin/bhyve/pci_xhci.c
  head/usr.sbin/bhyve/usb_mouse.c

-- 
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-virtualization@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-virtualization
To unsubscribe, send any mail to "freebsd-virtualization-unsubscribe@freebsd.org"
[prev in list] [next in list] [prev in thread] [next in thread]