diff mbox

usb: xHCI: add check to limit command TRB processing

Message ID 1475733011-22266-1-git-send-email-ppandit@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Prasad Pandit Oct. 6, 2016, 5:50 a.m. UTC 
From: Prasad J Pandit <pjp@fedoraproject.org>

USB xHCI controller uses ring of Transfer Request Blocks(TRB)
to process USB commands. These are processed by loop in
'xhci_ring_fetch'. A guest user could make it read and process
a same TRB infinitely. Limit number of command TRBs to avoid it.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/usb/hcd-xhci.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
diff mbox

Patch

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 188f954..17dba2a 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -140,6 +140,7 @@ 
 #define ERDP_EHB        (1<<3)
 
 #define TRB_SIZE 16
+#define TRB_MAX  4000
 typedef struct XHCITRB {
     uint64_t parameter;
     uint32_t status;
@@ -999,9 +1000,10 @@  static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
                                dma_addr_t *addr)
 {
+    uint16_t trbcnt = 0;
     PCIDevice *pci_dev = PCI_DEVICE(xhci);
 
-    while (1) {
+    while (trbcnt++ < TRB_MAX) {
         TRBType type;
         pci_dma_read(pci_dev, ring->dequeue, trb, TRB_SIZE);
         trb->addr = ring->dequeue;
@@ -1032,6 +1034,8 @@  static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
             }
         }
     }
+
+    return 0;
 }
 
 static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)