diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2013-03-20 11:40:02 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2013-04-03 11:39:43 +0200 |
| commit | c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b (patch) | |
| tree | 5baada12d24aa414379ba75d5e4b12142fca934c /hw/usb/dev-hub.c | |
| parent | 4b7b2afae773f00c785724261079ef211fd6021b (diff) | |
| download | qemu-c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b.tar.gz | |
usb-hub: limit chain length
USB supports up to 5 hubs chained.
Catch attempts to chain more.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb/dev-hub.c')
| -rw-r--r-- | hw/usb/dev-hub.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c index 504c98c350..a5f092bfee 100644 --- a/hw/usb/dev-hub.c +++ b/hw/usb/dev-hub.c @@ -25,6 +25,7 @@ #include "trace.h" #include "hw/usb.h" #include "hw/usb/desc.h" +#include "qemu/error-report.h" #define NUM_PORTS 8 @@ -514,6 +515,11 @@ static int usb_hub_initfn(USBDevice *dev) USBHubPort *port; int i; + if (dev->port->hubcount == 5) { + error_report("usb hub chain too deep"); + return -1; + } + usb_desc_create_serial(dev); usb_desc_init(dev); s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1); |