ae23c9
From d6ab4b2c2b8dac019452a9237def64ac7c9803a1 Mon Sep 17 00:00:00 2001
ae23c9
From: Gerd Hoffmann <kraxel@redhat.com>
ae23c9
Date: Wed, 4 Jul 2018 09:00:54 +0200
ae23c9
Subject: [PATCH 186/268] xhci: fix guest-triggerable assert
ae23c9
ae23c9
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
ae23c9
Message-id: <20180704090054.5101-2-kraxel@redhat.com>
ae23c9
Patchwork-id: 81224
ae23c9
O-Subject: [RHEL-7.6 qemu-kvm-rhev PATCH 1/1] xhci: fix guest-triggerable assert
ae23c9
Bugzilla: 1594135
ae23c9
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
ae23c9
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
ae23c9
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
ae23c9
ae23c9
Set xhci into error state instead of throwing a core dump.
ae23c9
ae23c9
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ae23c9
Message-id: 20180702162752.29233-1-kraxel@redhat.com
ae23c9
(cherry picked from commit 8f36ec708834dfad58af6feb0b69bb0be6077f0f)
ae23c9
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
ae23c9
---
ae23c9
 hw/usb/hcd-xhci.c | 7 ++++++-
ae23c9
 1 file changed, 6 insertions(+), 1 deletion(-)
ae23c9
ae23c9
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
ae23c9
index 181e803..45fcce3 100644
ae23c9
--- a/hw/usb/hcd-xhci.c
ae23c9
+++ b/hw/usb/hcd-xhci.c
ae23c9
@@ -1954,7 +1954,12 @@ static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
ae23c9
         for (i = 0; i < length; i++) {
ae23c9
             TRBType type;
ae23c9
             type = xhci_ring_fetch(xhci, ring, &xfer->trbs[i], NULL);
ae23c9
-            assert(type);
ae23c9
+            if (!type) {
ae23c9
+                xhci_die(xhci);
ae23c9
+                xhci_ep_free_xfer(xfer);
ae23c9
+                epctx->kick_active--;
ae23c9
+                return;
ae23c9
+            }
ae23c9
         }
ae23c9
         xfer->streamid = streamid;
ae23c9
 
ae23c9
-- 
ae23c9
1.8.3.1
ae23c9