From nobody Mon May 6 06:27:55 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 148646314820413.490429010955268; Tue, 7 Feb 2017 02:25:48 -0800 (PST) Received: from localhost ([::1]:53086 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb2y2-00028U-U6 for importer@patchew.org; Tue, 07 Feb 2017 05:25:47 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40485) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb2w7-0000rT-6b for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cb2w4-0002NI-3q for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:47 -0500 Received: from mail-it0-x243.google.com ([2607:f8b0:4001:c0b::243]:33972) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cb2w3-0002NC-Vi for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:44 -0500 Received: by mail-it0-x243.google.com with SMTP id o185so11886960itb.1 for ; Tue, 07 Feb 2017 02:23:43 -0800 (PST) Received: from localhost.localdomain.localdomain ([104.192.110.250]) by smtp.gmail.com with ESMTPSA id k66sm5808829itg.8.2017.02.07.02.23.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Feb 2017 02:23:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:from:to:cc:subject:date; bh=kvfFOVuc6GBo4IF5VQuiqvVaon7miutvQmQsOTXFT4E=; b=NpY3G+zluUPfmHNtlNxOavmu1IWvK9x/GgCd3Q+JJBrO7yI2ZwXUinbiiRMbuHYKLC ucThgnm0TBwHvhn5o5ZLmknJlEP0dvN5uXlvBLWR+vI+Aur1KnDQ6ArTJRo6ITS1G/Z1 15f3A9VJ2+q/pL8N4hpNHtUEpgFZxLRpyeI+DZXGVoGkMPp44L5zexvcTg5sDSppu6Fq 2HyBgbJQyqLkBrkER7B2mNo79NYl2MKtgY40bcBLrbKfWWsoP9SVo8LyBlmaJFwX9fdJ 6Rykj2Hmp4SIap2+FHsi51Xe+lPnYBIJdqR6gZhi7PpeqpGZ4xa8sChnRRCNN7AhXyK9 6Ilw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:from:to:cc:subject:date; bh=kvfFOVuc6GBo4IF5VQuiqvVaon7miutvQmQsOTXFT4E=; b=dcfwtbR5P2Wj3pBt/imMxD3Kkt6Bt/lFXx0PD3LswrfOE3mWWHPBtIMkfA4g5IC2i7 8DB7CXUQhc0GKFQHH7aDc0aQuXV9oOGHqfvpl4fOmE04q+hYSU9ZCdlUjeFEedw9kqOO nQoUd9qVFaTndRkuHP1bjz0WOKLxopq3zwVgzgJHfU9JS6mcGLFcqSTgrvo+QLpxWq4A TUGQa491fN5meOODCfpQ9BxUFlN+AWJunWgT9FtnSiz3BhK3Snliwp4XzS9YBySaA0Qa o24ZVrf4aXhK2z3joGXUhH+OYWZD8XABYH/SOD+roterArycM97OH1xXfajQw6wfmcQc wK8g== X-Gm-Message-State: AIkVDXJiTued/tAi3AdqEzJWjePFXXz6h34SjS7awwqmB1f+mZTqZQLmH0KtG+OY9NU2fA== X-Received: by 10.36.250.201 with SMTP id v192mr11261082ith.43.1486463023311; Tue, 07 Feb 2017 02:23:43 -0800 (PST) Message-ID: <5899a02e.45ca240a.6c373.93c1@mx.google.com> X-Google-Original-Message-ID: <1486463013-127287-1-git-send-email-Qiang(liqiang6-s@360.cn)> From: Li Qiang X-Google-Original-From: Li Qiang(liqiang6-s@360.cn) To: kraxel@redhat.com, qemu-devel@nongnu.org Date: Tue, 7 Feb 2017 02:23:33 -0800 X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2607:f8b0:4001:c0b::243 Subject: [Qemu-devel] [PATCH] usb: ohci: limit the number of link eds X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Li Qiang Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Li Qiang The guest may builds an infinite loop with link eds. This patch limit the number of linked ed to avoid this. Signed-off-by: Li Qiang --- hw/usb/hcd-ohci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index c82a92f..4a63f3b 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -42,6 +42,8 @@ =20 #define OHCI_MAX_PORTS 15 =20 +#define ED_LINK_LIMIT 4 + static int64_t usb_frame_time; static int64_t usb_bit_time; =20 @@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint= 32_t head, int completion) uint32_t next_ed; uint32_t cur; int active; - + uint32_t link_cnt =3D 0; active =3D 0; =20 if (head =3D=3D 0) @@ -1199,6 +1201,11 @@ static int ohci_service_ed_list(OHCIState *ohci, uin= t32_t head, int completion) =20 next_ed =3D ed.next & OHCI_DPTR_MASK; =20 + if (++link_cnt > ED_LINK_LIMIT) { + ohci_die(ohci); + return 0; + } + if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) { uint32_t addr; /* Cancel pending packets for ED that have been paused. */ --=20 1.8.3.1