@samitouri / QOSamiQemu / commits / 5257259428

hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()

The FIXME macros in xhci_alloc_device_streams() can be triggered by a (malicious) guest. Since the macro also contains an abort() statement, this terminates QEMU. Turn the FIXME statements into a qemu_log_mask() instead to avoid that a guest can shoot itself this way. Reported-by: Feifan Qian <bea1e@proton.me> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3784 Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20260713161406.361197-2-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Thomas Huth committed Jul 13, 2026 at 18:14 UTC 5257259428eaa305b76e63e5657448a39de0570f
1 file changed +4 -2
hw/usb/hcd-xhci.c
+4 -2
@@ -965,11 +965,13 @@ static TRBCCode xhci_alloc_device_streams(XHCIState *xhci, unsigned int slotid,
965 * together and make an usb_device_alloc_streams call per group.
966 */
967 if (epctxs[i]->nr_pstreams != req_nr_streams) {
968 - FIXME("guest streams config not identical for all eps");
968 + qemu_log_mask(LOG_UNIMP,
969 + "guest streams config not identical for all eps\n");
970 return CC_RESOURCE_ERROR;
971 }
972 if (eps[i]->max_streams != dev_max_streams) {
972 - FIXME("device streams config not identical for all eps");
973 + qemu_log_mask(LOG_UNIMP,
974 + "device streams config not identical for all eps\n");
975 return CC_RESOURCE_ERROR;
976 }
977 }