From 20009bdaf95d10bf748fa69b104672d3cfaceddf Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Fri, 7 Oct 2016 10:15:29 +0200
Subject: [PATCH] xhci: limit the number of link trbs we are willing to process

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/hcd-xhci.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 726435c..ee4fa48 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -54,6 +54,8 @@
  * to the specs when it gets them */
 #define ER_FULL_HACK
 
+#define TRB_LINK_LIMIT  4
+
 #define LEN_CAP         0x40
 #define LEN_OPER        (0x400 + 0x10 * MAXPORTS)
 #define LEN_RUNTIME     ((MAXINTRS + 1) * 0x20)
@@ -1000,6 +1002,7 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
                                dma_addr_t *addr)
 {
     PCIDevice *pci_dev = PCI_DEVICE(xhci);
+    uint32_t link_cnt = 0;
 
     while (1) {
         TRBType type;
@@ -1026,6 +1029,9 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
             ring->dequeue += TRB_SIZE;
             return type;
         } else {
+            if (++link_cnt > TRB_LINK_LIMIT) {
+                return 0;
+            }
             ring->dequeue = xhci_mask64(trb->parameter);
             if (trb->control & TRB_LK_TC) {
                 ring->ccs = !ring->ccs;
@@ -1043,6 +1049,7 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
     bool ccs = ring->ccs;
     /* hack to bundle together the two/three TDs that make a setup transfer */
     bool control_td_set = 0;
+    uint32_t link_cnt = 0;
 
     while (1) {
         TRBType type;
@@ -1058,6 +1065,9 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
         type = TRB_TYPE(trb);
 
         if (type == TR_LINK) {
+            if (++link_cnt > TRB_LINK_LIMIT) {
+                return -length;
+            }
             dequeue = xhci_mask64(trb.parameter);
             if (trb.control & TRB_LK_TC) {
                 ccs = !ccs;
-- 
1.8.3.1

type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59'>root</a>/<a href='/guix/log/gnu?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59'>gnu</a>/<a href='/guix/log/gnu/packages?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59'>packages</a>/<a href='/guix/log/gnu/packages/patches?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59'>patches</a>/<a href='/guix/log/gnu/packages/patches/clang-libc-search-path.patch?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59'>clang-libc-search-path.patch</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/patches/clang-libc-search-path.patch?id=1c851cbe0c562894bd38c0f9f39d12be306b3e59&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2015-07-24 17:29:37 +0200'>2015-07-24</span></td><td><a href='/guix/commit/gnu/packages/patches/clang-libc-search-path.patch?id=47e0ba8fe54ad98f5d4e6bdc45b1ec5017e09c0b'>gnu: clang: Disable distro detection and remove FHS assumptions.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2015-06-19 17:23:48 +0200'>2015-06-19</span></td><td><a href='/guix/commit/gnu/packages/patches/clang-libc-search-path.patch?id=fd6ae1b9836ffe74105f26930d101d1297849740'>gnu: clang: Allow 'clang' to link executables.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>