hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop
When a guest sets MaxPacketSize to 0 in an OHCI Endpoint Descriptor, ohci_service_td() transfers 0 bytes per iteration. The Transfer Descriptor never completes because CBP never advances toward BE, causing ohci_service_ed_list() to loop indefinitely and hang QEMU. Add a check for MPS==0 after extracting the field from ED flags. If MPS is zero, call ohci_die() to reset the controller and return an error, preventing the infinite loop. Fixes: CVE-2026-3890 Reported-by: Jenny Guanni Qu <qguanni@gmail.com> Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20260321000444.909451-1-qguanni@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Jenny Guanni Qu committed
Mar 21, 2026 at 00:04 UTC
129922c2bc398b656a9180150e667f98fdf0d402
1 file changed
+11
hw/usb/hcd-ohci.c
+11
@@ -956,6 +956,17 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
956
if (len && dir != OHCI_TD_DIR_IN) {
957
/* The endpoint may not allow us to transfer it all now */
958
pktlen = (ed->flags & OHCI_ED_MPS_MASK) >> OHCI_ED_MPS_SHIFT;
959
+ /*
960
+ * The OHCI spec does not say what to do if the guest hands us
961
+ * an endpoint descriptor which specifies a MaximumPacketSize
962
+ * of zero, which would mean we can never actually make forward
963
+ * progress transferring data to it. We choose to treat it as
964
+ * an error.
965
+ */
966
+ if (pktlen == 0) {
967
+ ohci_die(ohci);
968
+ return 1;
969
+ }
970
if (pktlen > len) {
971
pktlen = len;
972
}