--- a/sys/bus/pccard/pccard_cis.c +++ b/sys/bus/pccard/pccard_cis.c @@ -104,6 +104,7 @@ struct pccard_tuple tuple; int longlink_present; int longlink_common; + int chain_hops = 0; /* DF-5362 cycle guard */ u_long longlink_addr; /* Type suspect */ int mfc_count; int mfc_index; @@ -384,6 +385,16 @@ * try the next one, instead of just bailing. */ while (1) { + /* DF-5362: LONGLINK_A/C tuples parsed inside a + * followed chain re-arm longlink_present, so a + * cyclic chain graph never terminates. Real + * cards use one implicit longlink plus at most + * 50 MFC links; cut off pathological graphs. */ + if (++chain_hops > 64) { + device_printf(dev, "CIS chain hop limit" + " exceeded (cycle?) -- truncating\n"); + goto done; + } if (longlink_present) { CARD_SET_RES_FLAGS(device_get_parent(dev), dev, SYS_RES_MEMORY, rid, longlink_common ?