diff options
| author | Prasad J Pandit | 2020-09-15 20:22:59 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2020-09-21 09:44:54 +0200 |
| commit | 1be90ebecc95b09a2ee5af3f60c412b45a766c4f (patch) | |
| tree | 43161ab3ee0d96c5dc1e695ab6a1bc83078a5a36 /hw/usb | |
| parent | hw: usb: hcd-ohci: check len and frame_number variables (diff) | |
| download | qemu-1be90ebecc95b09a2ee5af3f60c412b45a766c4f.tar.gz qemu-1be90ebecc95b09a2ee5af3f60c412b45a766c4f.tar.xz qemu-1be90ebecc95b09a2ee5af3f60c412b45a766c4f.zip | |
hw: usb: hcd-ohci: check for processed TD before retire
While servicing OHCI transfer descriptors(TD), ohci_service_iso_td
retires a TD if it has passed its time frame. It does not check if
the TD was already processed once and holds an error code in TD_CC.
It may happen if the TD list has a loop. Add check to avoid an
infinite loop condition.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20200915182259.68522-3-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb')
| -rw-r--r-- | hw/usb/hcd-ohci.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c index 9dc59101f9..8b912e95d3 100644 --- a/hw/usb/hcd-ohci.c +++ b/hw/usb/hcd-ohci.c @@ -691,6 +691,10 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed, the next ISO TD of the same ED */ trace_usb_ohci_iso_td_relative_frame_number_big(relative_frame_number, frame_count); + if (OHCI_CC_DATAOVERRUN == OHCI_BM(iso_td.flags, TD_CC)) { + /* avoid infinite loop */ + return 1; + } OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN); ed->head &= ~OHCI_DPTR_MASK; ed->head |= (iso_td.next & OHCI_DPTR_MASK); |