[Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing

[P J P]

From: Prasad J Pandit <address@hidden>

USB xHCI controller uses ring of Transfer Request Blocks(TRB)
to process USB commands. These are processed by loop in
'xhci_ring_fetch'. A guest user could make it read and process
a same TRB infinitely. Limit number of command TRBs to avoid it.

Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
 hw/usb/hcd-xhci.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 188f954..17dba2a 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -140,6 +140,7 @@
 #define ERDP_EHB        (1<<3)
 
 #define TRB_SIZE 16
+#define TRB_MAX  4000
 typedef struct XHCITRB {
     uint64_t parameter;
     uint32_t status;
@@ -999,9 +1000,10 @@ static void xhci_ring_init(XHCIState *xhci, XHCIRing 
*ring,
 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
                                dma_addr_t *addr)
 {
+    uint16_t trbcnt = 0;
     PCIDevice *pci_dev = PCI_DEVICE(xhci);
 
-    while (1) {
+    while (trbcnt++ < TRB_MAX) {
         TRBType type;
         pci_dma_read(pci_dev, ring->dequeue, trb, TRB_SIZE);
         trb->addr = ring->dequeue;
@@ -1032,6 +1034,8 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing 
*ring, XHCITRB *trb,
             }
         }
     }
+
+    return 0;
 }
 
 static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
-- 
2.5.5