| Message ID | 20200915182259.68522-3-ppandit@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | hw: usb: hcd-ohci: fix oob access and loop issues | expand |
P J P <ppandit@redhat.com> 于2020年9月16日周三 上午2:25写道： > > From: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> > > While servicing OHCI transfer descriptors(TD), ohci_service_iso_td > retires a TD if it has passed its time frame. It does not check if > the TD was already processed once and holds an error code in TD_CC. > It may happen if the TD list has a loop. Add check to avoid an > infinite loop condition. > > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > --- > hw/usb/hcd-ohci.c | 4 ++++ > 1 file changed, 4 insertions(+) > > Update v2: one patch for loop issue > -> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05145.html > > diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c > index 9dc59101f9..8b912e95d3 100644 > --- a/hw/usb/hcd-ohci.c > +++ b/hw/usb/hcd-ohci.c > @@ -691,6 +691,10 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed, > the next ISO TD of the same ED */ > trace_usb_ohci_iso_td_relative_frame_number_big(relative_frame_number, > frame_count); > + if (OHCI_CC_DATAOVERRUN == OHCI_BM(iso_td.flags, TD_CC)) { > + /* avoid infinite loop */ > + return 1; > + } > OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN); > ed->head &= ~OHCI_DPTR_MASK; > ed->head |= (iso_td.next & OHCI_DPTR_MASK); > -- > 2.26.2 >
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index 9dc59101f9..8b912e95d3 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -691,6 +691,10 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed, the next ISO TD of the same ED */ trace_usb_ohci_iso_td_relative_frame_number_big(relative_frame_number, frame_count); + if (OHCI_CC_DATAOVERRUN == OHCI_BM(iso_td.flags, TD_CC)) { + /* avoid infinite loop */ + return 1; + } OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN); ed->head &= ~OHCI_DPTR_MASK; ed->head |= (iso_td.next & OHCI_DPTR_MASK);