diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2013-03-20 11:40:02 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2013-04-03 11:39:43 +0200 |
| commit | c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b (patch) | |
| tree | 5baada12d24aa414379ba75d5e4b12142fca934c /hw/usb | |
| parent | 4b7b2afae773f00c785724261079ef211fd6021b (diff) | |
| download | qemu-c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b.zip qemu-c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b.tar.gz qemu-c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b.tar.bz2 | |
usb-hub: limit chain length
USB supports up to 5 hubs chained.
Catch attempts to chain more.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb')
| -rw-r--r-- | hw/usb/bus.c | 2 | ||||
| -rw-r--r-- | hw/usb/dev-hub.c | 6 |
2 files changed, 8 insertions, 0 deletions
diff --git a/hw/usb/bus.c b/hw/usb/bus.c index e58cd9a..b10c290 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -341,8 +341,10 @@ void usb_port_location(USBPort *downstream, USBPort *upstream, int portnr) if (upstream) { snprintf(downstream->path, sizeof(downstream->path), "%s.%d", upstream->path, portnr); + downstream->hubcount = upstream->hubcount + 1; } else { snprintf(downstream->path, sizeof(downstream->path), "%d", portnr); + downstream->hubcount = 0; } } diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c index 504c98c..a5f092b 100644 --- a/hw/usb/dev-hub.c +++ b/hw/usb/dev-hub.c @@ -25,6 +25,7 @@ #include "trace.h" #include "hw/usb.h" #include "hw/usb/desc.h" +#include "qemu/error-report.h" #define NUM_PORTS 8 @@ -514,6 +515,11 @@ static int usb_hub_initfn(USBDevice *dev) USBHubPort *port; int i; + if (dev->port->hubcount == 5) { + error_report("usb hub chain too deep"); + return -1; + } + usb_desc_create_serial(dev); usb_desc_init(dev); s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1); |