CVE-2017-9375 fix cause qemu crash

[RussianNeuroMancer]

CVE-2017-9375 fix cause qemu crash on Ubuntu 17.04 if USB 3 controller is selected in virtual machine properties.

To reproduce this issue:
1. Install Ubuntu 17.04
2. Install package ubuntu-virt
3. Create virtual machine with USB 3 controller
4. Try to start this virtual machine

Error message from libvirt log:
qemu-system-x86_64: /build/qemu-g5EXBU/qemu-2.8+dfsg/hw/usb/hcd-xhci.c:2169: xhci_kick_epctx: Assertion `!epctx->kick_active' failed.

Workaround:
Switch controller type to USB 2, but AFAIK this is not applicable if user need to passthrough many USB devices to guest, or if user actually need USB 3 speed.

[RussianNeuroMancer (russianneuromancer)]

Example of xml that cause qemu crash on updated Ubuntu 17.04.

[RussianNeuroMancer (russianneuromancer)]

https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg09322.html

[RussianNeuroMancer (russianneuromancer)]

https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg03793.html

[RussianNeuroMancer (russianneuromancer)]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869945

[Christian Ehrhardt  (paelzer)]

Subscribing Mark who did the fix for his check on the case.
And setting regression-upgrade until we know otherwise.

[Christian Ehrhardt  (paelzer)]

Oh tag was already set, thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package qemu - 1:2.8+dfsg-3ubuntu2.5

---------------
qemu (1:2.8+dfsg-3ubuntu2.5) zesty-security; urgency=medium

  * SECURITY REGRESSION: regression in in USB xHCI emulation (LP: #1718222)
    - debian/patches/CVE-2017-9375-regression.patch: don't kick in
      xhci_submit and xhci_fire_ctl_transfer in hw/usb/hcd-xhci.c.

 -- Marc Deslauriers <email address hidden> Wed, 20 Sep 2017 07:22:48 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package qemu - 2.0.0+dfsg-2ubuntu1.36

---------------
qemu (2.0.0+dfsg-2ubuntu1.36) trusty-security; urgency=medium

  * SECURITY REGRESSION: regression in in USB xHCI emulation (LP: #1718222)
    - debian/patches/CVE-2017-9375-regression.patch: don't kick in
      xhci_submit and xhci_fire_ctl_transfer in hw/usb/hcd-xhci.c.

 -- Marc Deslauriers <email address hidden> Wed, 20 Sep 2017 07:27:30 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package qemu - 1:2.5+dfsg-5ubuntu10.16

---------------
qemu (1:2.5+dfsg-5ubuntu10.16) xenial-security; urgency=medium

  * SECURITY REGRESSION: regression in in USB xHCI emulation (LP: #1718222)
    - debian/patches/CVE-2017-9375-regression.patch: don't kick in
      xhci_submit and xhci_fire_ctl_transfer in hw/usb/hcd-xhci.c.

 -- Marc Deslauriers <email address hidden> Wed, 20 Sep 2017 07:25:44 -0400

[RussianNeuroMancer (russianneuromancer)]

Thanks for fast fix! :)

[Marc Deslauriers (mdeslaur)]

Thanks for the links, they were very helpful! :)