Re: [Qemu-devel] [PATCH] usb: fix up post load checks

[Gerd Hoffmann]

  Hi,


> And SETUP_STATE_PARAM?

Shortcut for small control transfers on xhci.  Doesn't go through the
idle -> setup -> data -> ack state engine.

security-wise: you can't go from 'param' to 'data' without 'setup'
inbetween.  beside that index should still be zero at the point where
len is modified (simliar to the other place in setup state).

side note: changing len should not happen in normal operation, only with
a malicious / buggy guest.  It happens in case the guest claims the data
transfer is larger than the buffer supplied by the guest.

cheers,
  Gerd