From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40485) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb2w7-0000rT-6b for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cb2w4-0002NI-3q for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:47 -0500 Received: from mail-it0-x243.google.com ([2607:f8b0:4001:c0b::243]:33972) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cb2w3-0002NC-Vi for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:44 -0500 Received: by mail-it0-x243.google.com with SMTP id o185so11886960itb.1 for ; Tue, 07 Feb 2017 02:23:43 -0800 (PST) Message-ID: <5899a02e.45ca240a.6c373.93c1@mx.google.com> From: Li Qiang Date: Tue, 7 Feb 2017 02:23:33 -0800 Subject: [Qemu-devel] [PATCH] usb: ohci: limit the number of link eds List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: kraxel@redhat.com, qemu-devel@nongnu.org Cc: Li Qiang From: Li Qiang The guest may builds an infinite loop with link eds. This patch limit the number of linked ed to avoid this. Signed-off-by: Li Qiang --- hw/usb/hcd-ohci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index c82a92f..4a63f3b 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -42,6 +42,8 @@ #define OHCI_MAX_PORTS 15 +#define ED_LINK_LIMIT 4 + static int64_t usb_frame_time; static int64_t usb_bit_time; @@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) uint32_t next_ed; uint32_t cur; int active; - + uint32_t link_cnt = 0; active = 0; if (head == 0) @@ -1199,6 +1201,11 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) next_ed = ed.next & OHCI_DPTR_MASK; + if (++link_cnt > ED_LINK_LIMIT) { + ohci_die(ohci); + return 0; + } + if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) { uint32_t addr; /* Cancel pending packets for ED that have been paused. */ -- 1.8.3.1