From patchwork Tue Feb 7 10:23:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Qiang X-Patchwork-Id: 9559657 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9FD236047A for ; Tue, 7 Feb 2017 10:24:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 926FB22701 for ; Tue, 7 Feb 2017 10:24:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8710628343; Tue, 7 Feb 2017 10:24:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1325F22701 for ; Tue, 7 Feb 2017 10:24:44 +0000 (UTC) Received: from localhost ([::1]:53078 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb2x1-0001FX-4g for patchwork-qemu-devel@patchwork.kernel.org; Tue, 07 Feb 2017 05:24:43 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40485) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb2w7-0000rT-6b for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cb2w4-0002NI-3q for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:47 -0500 Received: from mail-it0-x243.google.com ([2607:f8b0:4001:c0b::243]:33972) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cb2w3-0002NC-Vi for qemu-devel@nongnu.org; Tue, 07 Feb 2017 05:23:44 -0500 Received: by mail-it0-x243.google.com with SMTP id o185so11886960itb.1 for ; Tue, 07 Feb 2017 02:23:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:from:to:cc:subject:date; bh=kvfFOVuc6GBo4IF5VQuiqvVaon7miutvQmQsOTXFT4E=; b=NpY3G+zluUPfmHNtlNxOavmu1IWvK9x/GgCd3Q+JJBrO7yI2ZwXUinbiiRMbuHYKLC ucThgnm0TBwHvhn5o5ZLmknJlEP0dvN5uXlvBLWR+vI+Aur1KnDQ6ArTJRo6ITS1G/Z1 15f3A9VJ2+q/pL8N4hpNHtUEpgFZxLRpyeI+DZXGVoGkMPp44L5zexvcTg5sDSppu6Fq 2HyBgbJQyqLkBrkER7B2mNo79NYl2MKtgY40bcBLrbKfWWsoP9SVo8LyBlmaJFwX9fdJ 6Rykj2Hmp4SIap2+FHsi51Xe+lPnYBIJdqR6gZhi7PpeqpGZ4xa8sChnRRCNN7AhXyK9 6Ilw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:from:to:cc:subject:date; bh=kvfFOVuc6GBo4IF5VQuiqvVaon7miutvQmQsOTXFT4E=; b=dcfwtbR5P2Wj3pBt/imMxD3Kkt6Bt/lFXx0PD3LswrfOE3mWWHPBtIMkfA4g5IC2i7 8DB7CXUQhc0GKFQHH7aDc0aQuXV9oOGHqfvpl4fOmE04q+hYSU9ZCdlUjeFEedw9kqOO nQoUd9qVFaTndRkuHP1bjz0WOKLxopq3zwVgzgJHfU9JS6mcGLFcqSTgrvo+QLpxWq4A TUGQa491fN5meOODCfpQ9BxUFlN+AWJunWgT9FtnSiz3BhK3Snliwp4XzS9YBySaA0Qa o24ZVrf4aXhK2z3joGXUhH+OYWZD8XABYH/SOD+roterArycM97OH1xXfajQw6wfmcQc wK8g== X-Gm-Message-State: AIkVDXJiTued/tAi3AdqEzJWjePFXXz6h34SjS7awwqmB1f+mZTqZQLmH0KtG+OY9NU2fA== X-Received: by 10.36.250.201 with SMTP id v192mr11261082ith.43.1486463023311; Tue, 07 Feb 2017 02:23:43 -0800 (PST) Received: from localhost.localdomain.localdomain ([104.192.110.250]) by smtp.gmail.com with ESMTPSA id k66sm5808829itg.8.2017.02.07.02.23.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Feb 2017 02:23:42 -0800 (PST) Message-ID: <5899a02e.45ca240a.6c373.93c1@mx.google.com> X-Google-Original-Message-ID: <1486463013-127287-1-git-send-email-Qiang(liqiang6-s@360.cn)> From: Li Qiang X-Google-Original-From: Li Qiang(liqiang6-s@360.cn) To: kraxel@redhat.com, qemu-devel@nongnu.org Date: Tue, 7 Feb 2017 02:23:33 -0800 X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2607:f8b0:4001:c0b::243 Subject: [Qemu-devel] [PATCH] usb: ohci: limit the number of link eds X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Li Qiang Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Li Qiang The guest may builds an infinite loop with link eds. This patch limit the number of linked ed to avoid this. Signed-off-by: Li Qiang --- hw/usb/hcd-ohci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index c82a92f..4a63f3b 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -42,6 +42,8 @@ #define OHCI_MAX_PORTS 15 +#define ED_LINK_LIMIT 4 + static int64_t usb_frame_time; static int64_t usb_bit_time; @@ -1184,7 +1186,7 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) uint32_t next_ed; uint32_t cur; int active; - + uint32_t link_cnt = 0; active = 0; if (head == 0) @@ -1199,6 +1201,11 @@ static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion) next_ed = ed.next & OHCI_DPTR_MASK; + if (++link_cnt > ED_LINK_LIMIT) { + ohci_die(ohci); + return 0; + } + if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) { uint32_t addr; /* Cancel pending packets for ED that have been paused. */