[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 03/18] cadence_gem: Avoid infinite loops with a misco
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 03/18] cadence_gem: Avoid infinite loops with a misconfigured buffer |
Date: |
Mon, 27 Jun 2016 15:44:55 +0100 |
From: Alistair Francis <address@hidden>
A guest can write zero to the DMACFG resulting in an infinite loop when
it reaches the while(bytes_to_copy) loop.
To avoid this issue enforce a minimum size for the RX buffer. Hardware
does not have this enforcement and relies on the guest to set a non-zero
value.
Signed-off-by: Alistair Francis <address@hidden>
Reported-by: Li Qiang <address@hidden>
Reported-by: P J P <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
---
hw/net/cadence_gem.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 0346f3e..e5f3c98 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState *nc, const
uint8_t *buf, size_t size)
GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL;
bytes_to_copy = size;
+ /* Hardware allows a zero value here but warns against it. To avoid QEMU
+ * indefinite loops we enforce a minimum value here
+ */
+ if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) {
+ rxbufsize = GEM_DMACFG_RBUFSZ_MUL;
+ }
+
/* Pad to minimum length. Assume FCS field is stripped, logic
* below will increment it to the real minimum of 64 when
* not FCS stripping
--
1.9.1
- [Qemu-devel] [PULL 18/18] m25p80: Fix WINBOND fast read command handling, (continued)
- [Qemu-devel] [PULL 18/18] m25p80: Fix WINBOND fast read command handling, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 10/18] m25p80: Make a table for JEDEC ID., Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 13/18] m25p80: Add additional flash commands:, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 12/18] m25p80: Introduce COLLECTING_VAR_LEN_DATA state., Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 04/18] cadence_gem: Set the last bit when wrap is set, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 01/18] hw/intc/arm_gicv3: Add missing break, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 11/18] m25p80: Allow more than four banks., Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 02/18] cadence_uart: Protect against transmit errors, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 17/18] m25p80: New flash devices., Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 06/18] hw/misc: Add a model for the ASPEED System Control Unit, Peter Maydell, 2016/06/27
- [Qemu-devel] [PULL 03/18] cadence_gem: Avoid infinite loops with a misconfigured buffer,
Peter Maydell <=
- Re: [Qemu-devel] [PULL 00/18] target-arm queue, Peter Maydell, 2016/06/27