hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()
The FIXME macros in xhci_alloc_device_streams() can be triggered by a (malicious) guest. Since the macro also contains an abort() statement, this terminates QEMU. Turn the FIXME statements into a qemu_log_mask() instead to avoid that a guest can shoot itself this way. Reported-by: Feifan Qian <bea1e@proton.me> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3784 Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20260713161406.361197-2-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Thomas Huth committed
Jul 13, 2026 at 18:14 UTC
5257259428eaa305b76e63e5657448a39de0570f
1 file changed
+4
-2
hw/usb/hcd-xhci.c
+4
-2
@@ -965,11 +965,13 @@ static TRBCCode xhci_alloc_device_streams(XHCIState *xhci, unsigned int slotid,
965
* together and make an usb_device_alloc_streams call per group.
966
*/
967
if (epctxs[i]->nr_pstreams != req_nr_streams) {
968
- FIXME("guest streams config not identical for all eps");
968
+ qemu_log_mask(LOG_UNIMP,
969
+ "guest streams config not identical for all eps\n");
970
return CC_RESOURCE_ERROR;
971
}
972
if (eps[i]->max_streams != dev_max_streams) {
972
- FIXME("device streams config not identical for all eps");
973
+ qemu_log_mask(LOG_UNIMP,
974
+ "device streams config not identical for all eps\n");
975
return CC_RESOURCE_ERROR;
976
}
977
}