$OpenBSD: patch-hw_usb_hcd-ohci_c,v 1.1 2016/02/20 22:46:46 ajacoutot Exp $

usb: ohci avoid multiple eof timers

When transitioning an OHCI controller to the OHCI_USB_OPERATIONAL
state, it creates an eof timer object in 'ohci_bus_start'.
It does not check if one already exists. This results in memory
leakage and null dereference issue. Add a check to avoid it.

CVE-2016-2391

--- hw/usb/hcd-ohci.c.orig	Tue Mar 10 13:38:27 2015
+++ hw/usb/hcd-ohci.c	Thu Feb 18 19:57:48 2016
@@ -1331,16 +1331,6 @@ static void ohci_frame_boundary(void *opaque)
  */
 static int ohci_bus_start(OHCIState *ohci)
 {
-    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                    ohci_frame_boundary,
-                    ohci);
-
-    if (ohci->eof_timer == NULL) {
-        trace_usb_ohci_bus_eof_timer_failed(ohci->name);
-        ohci_die(ohci);
-        return 0;
-    }
-
     trace_usb_ohci_start(ohci->name);
 
     ohci_sof(ohci);
@@ -1352,11 +1342,7 @@ static int ohci_bus_start(OHCIState *ohci)
 static void ohci_bus_stop(OHCIState *ohci)
 {
     trace_usb_ohci_stop(ohci->name);
-    if (ohci->eof_timer) {
-        timer_del(ohci->eof_timer);
-        timer_free(ohci->eof_timer);
-    }
-    ohci->eof_timer = NULL;
+    timer_del(ohci->eof_timer);
 }
 
 /* Sets a flag in a port status register but only set it if the port is
@@ -1879,6 +1865,10 @@ static int usb_ohci_init(OHCIState *ohci, DeviceState 
     usb_packet_init(&ohci->usb_packet);
 
     ohci->async_td = 0;
+
+    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                   ohci_frame_boundary, ohci);
+
     qemu_register_reset(ohci_reset, ohci);
 
     return 0;
@@ -1997,23 +1987,13 @@ static bool ohci_eof_timer_needed(void *opaque)
 {
     OHCIState *ohci = opaque;
 
-    return ohci->eof_timer != NULL;
+    return timer_pending(ohci->eof_timer);
 }
 
-static int ohci_eof_timer_pre_load(void *opaque)
-{
-    OHCIState *ohci = opaque;
-
-    ohci_bus_start(ohci);
-
-    return 0;
-}
-
 static const VMStateDescription vmstate_ohci_eof_timer = {
     .name = "ohci-core/eof-timer",
     .version_id = 1,
     .minimum_version_id = 1,
-    .pre_load = ohci_eof_timer_pre_load,
     .fields = (VMStateField[]) {
         VMSTATE_TIMER(eof_timer, OHCIState),
         VMSTATE_END_OF_LIST()
