Re: [Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing

2016-10-07 Thread P J P
Hello Gerd, +-- On Fri, 7 Oct 2016, Gerd Hoffmann wrote --+ | I think it is better to apply the limit to link trbs only (which allow | to jump to another address so the guest can build loops with it). Also | I think the limit can be much stricter then without breaking stuff as | typically a lin

Re: [Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing

2016-10-07 Thread Gerd Hoffmann
On Do, 2016-10-06 at 11:20 +0530, P J P wrote: > From: Prasad J Pandit > > USB xHCI controller uses ring of Transfer Request Blocks(TRB) > to process USB commands. These are processed by loop in > 'xhci_ring_fetch'. A guest user could make it read and process > a same TRB infinitely. Limit number

[Qemu-devel] [PATCH] usb: xHCI: add check to limit command TRB processing

2016-10-05 Thread P J P
From: Prasad J Pandit USB xHCI controller uses ring of Transfer Request Blocks(TRB) to process USB commands. These are processed by loop in 'xhci_ring_fetch'. A guest user could make it read and process a same TRB infinitely. Limit number of command TRBs to avoid it. Reported-by: Li Qiang Signe