Re: [PATCH] hw/usb/hcd-ohci: Make sure that ohci_service_ed_list() cannot loop forever

Daniel P. Berrangé <[email protected]> Mon, 13 Jul 2026 17:23:11 +0100

Newsgroups	org.nongnu.qemu-trivial,org.nongnu.qemu-devel
Message-ID	<[email protected]>

On Mon, Jul 13, 2026 at 06:04:58PM +0200, Thomas Huth wrote:
> From: Thomas Huth <[email protected]>
> 
> The inner while loop in ohci_service_ed_list() could theoretically
> loop forever if a malicious guest prepares a set of bad descriptors.
> Add a check to the loop to avoid this situation.
> 
> Reported-by: Feifan Qian <[email protected]>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3781
> Signed-off-by: Thomas Huth <[email protected]>
> ---
>  hw/usb/hcd-ohci.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>

Reviewed-by: Daniel P. Berrangé <[email protected]>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|