From c24e4aac3bd7dd6591e26b77985e5d3915ecbe4b Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 20 Mar 2013 11:40:02 +0100
Subject: usb-hub: limit chain length

USB supports up to 5 hubs chained.
Catch attempts to chain more.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/usb/dev-hub.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'hw/usb/dev-hub.c')

diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 504c98c350..a5f092bfee 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -25,6 +25,7 @@
 #include "trace.h"
 #include "hw/usb.h"
 #include "hw/usb/desc.h"
+#include "qemu/error-report.h"
 
 #define NUM_PORTS 8
 
@@ -514,6 +515,11 @@ static int usb_hub_initfn(USBDevice *dev)
     USBHubPort *port;
     int i;
 
+    if (dev->port->hubcount == 5) {
+        error_report("usb hub chain too deep");
+        return -1;
+    }
+
     usb_desc_create_serial(dev);
     usb_desc_init(dev);
     s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
-- 
cgit v1.2.1