[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processin
From: |
P J P |
Subject: |
[Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing |
Date: |
Thu, 6 Oct 2016 11:20:11 +0530 |
From: Prasad J Pandit <address@hidden>
USB xHCI controller uses ring of Transfer Request Blocks(TRB)
to process USB commands. These are processed by loop in
'xhci_ring_fetch'. A guest user could make it read and process
a same TRB infinitely. Limit number of command TRBs to avoid it.
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/usb/hcd-xhci.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 188f954..17dba2a 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -140,6 +140,7 @@
#define ERDP_EHB (1<<3)
#define TRB_SIZE 16
+#define TRB_MAX 4000
typedef struct XHCITRB {
uint64_t parameter;
uint32_t status;
@@ -999,9 +1000,10 @@ static void xhci_ring_init(XHCIState *xhci, XHCIRing
*ring,
static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
dma_addr_t *addr)
{
+ uint16_t trbcnt = 0;
PCIDevice *pci_dev = PCI_DEVICE(xhci);
- while (1) {
+ while (trbcnt++ < TRB_MAX) {
TRBType type;
pci_dma_read(pci_dev, ring->dequeue, trb, TRB_SIZE);
trb->addr = ring->dequeue;
@@ -1032,6 +1034,8 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing
*ring, XHCITRB *trb,
}
}
}
+
+ return 0;
}
static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
--
2.5.5
- [Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing,
P J P <=