Commit 95ed5693 authored by Li Qiang's avatar Li Qiang Committed by Gerd Hoffmann
Browse files

usb: ohci: limit the number of link eds 



The guest may builds an infinite loop with link eds. This patch
limit the number of linked ed to avoid this.

Signed-off-by: default avatarLi Qiang <liqiang6-s@360.cn>
Message-id: 5899a02e.45ca240a.6c373.93c1@mx.google.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 26f670a2

hw/usb/hcd-ohci.c

+8 −1
Original line number Diff line number Diff line
@@ -42,6 +42,8 @@ 


#define OHCI_MAX_PORTS 15



#define ED_LINK_LIMIT 4



static int64_t usb_frame_time;

static int64_t usb_bit_time;
@@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) 
    uint32_t next_ed;

    uint32_t cur;

    int active;



    uint32_t link_cnt = 0;

    active = 0;



    if (head == 0)
@@ -1199,6 +1201,11 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) 


        next_ed = ed.next & OHCI_DPTR_MASK;



        if (++link_cnt > ED_LINK_LIMIT) {

            ohci_die(ohci);

            return 0;

        }



        if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {

            uint32_t addr;

            /* Cancel pending packets for ED that have been paused.  */