|
 |
9ae3a8 |
From 0ebce8809c6cf12e4df5fe9fdf441b280176412e Mon Sep 17 00:00:00 2001
|
|
|
9ae3a8 |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9ae3a8 |
Date: Tue, 18 Nov 2014 11:42:20 +0100
|
|
|
9ae3a8 |
Subject: [PATCH 1/5] xhci: add sanity checks to xhci_lookup_uport
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Message-id: <1416310940-10391-2-git-send-email-kraxel@redhat.com>
|
|
|
9ae3a8 |
Patchwork-id: 62418
|
|
|
9ae3a8 |
O-Subject: [RHEL-7.1 qemu-kvm PATCH v2 1/1] xhci: add sanity checks to xhci_lookup_uport
|
|
|
9ae3a8 |
Bugzilla: 1074219
|
|
|
9ae3a8 |
RH-Acked-by: Dr. David Alan Gilbert (git) <dgilbert@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Marcel Apfelbaum <marcel.a@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Also catch xhci_lookup_uport failures in post_load.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9ae3a8 |
(cherry picked from commit f2ad97ff81da51c064b9e87720ff48a0874f45d4)
|
|
|
9ae3a8 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
hw/usb/hcd-xhci.c | 9 +++++++++
|
|
|
9ae3a8 |
1 file changed, 9 insertions(+)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
|
|
|
9ae3a8 |
index 32568cb..ce81632 100644
|
|
|
9ae3a8 |
--- a/hw/usb/hcd-xhci.c
|
|
|
9ae3a8 |
+++ b/hw/usb/hcd-xhci.c
|
|
|
9ae3a8 |
@@ -2254,6 +2254,9 @@ static USBPort *xhci_lookup_uport(XHCIState *xhci, uint32_t *slot_ctx)
|
|
|
9ae3a8 |
int i, pos, port;
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
port = (slot_ctx[1]>>16) & 0xFF;
|
|
|
9ae3a8 |
+ if (port < 1 || port > xhci->numports) {
|
|
|
9ae3a8 |
+ return NULL;
|
|
|
9ae3a8 |
+ }
|
|
|
9ae3a8 |
port = xhci->ports[port-1].uport->index+1;
|
|
|
9ae3a8 |
pos = snprintf(path, sizeof(path), "%d", port);
|
|
|
9ae3a8 |
for (i = 0; i < 5; i++) {
|
|
|
9ae3a8 |
@@ -3637,6 +3640,12 @@ static int usb_xhci_post_load(void *opaque, int version_id)
|
|
|
9ae3a8 |
xhci_mask64(ldq_le_pci_dma(pci_dev, dcbaap + 8 * slotid));
|
|
|
9ae3a8 |
xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
|
|
|
9ae3a8 |
slot->uport = xhci_lookup_uport(xhci, slot_ctx);
|
|
|
9ae3a8 |
+ if (!slot->uport) {
|
|
|
9ae3a8 |
+ /* should not happen, but may trigger on guest bugs */
|
|
|
9ae3a8 |
+ slot->enabled = 0;
|
|
|
9ae3a8 |
+ slot->addressed = 0;
|
|
|
9ae3a8 |
+ continue;
|
|
|
9ae3a8 |
+ }
|
|
|
9ae3a8 |
assert(slot->uport && slot->uport->dev);
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
for (epid = 1; epid <= 31; epid++) {
|
|
|
9ae3a8 |
--
|
|
|
9ae3a8 |
1.8.3.1
|
|
|
9ae3a8 |
|