[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/9] net: rocker: set limit to DMA buffer size
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 5/9] net: rocker: set limit to DMA buffer size |
Date: |
Wed, 26 Oct 2016 10:24:07 +0800 |
From: Prasad J Pandit <address@hidden>
Rocker network switch emulator has test registers to help debug
DMA operations. While testing host DMA access, a buffer address
is written to register 'TEST_DMA_ADDR' and its size is written to
register 'TEST_DMA_SIZE'. When performing TEST_DMA_CTRL_INVERT
test, if DMA buffer size was greater than 'INT_MAX', it leads to
an invalid buffer access. Limit the DMA buffer size to avoid it.
Reported-by: Huawei PSIRT <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Reviewed-by: Jiri Pirko <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/rocker/rocker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
index 30f2ce4..e9d215a 100644
--- a/hw/net/rocker/rocker.c
+++ b/hw/net/rocker/rocker.c
@@ -860,7 +860,7 @@ static void rocker_io_writel(void *opaque, hwaddr addr,
uint32_t val)
rocker_msix_irq(r, val);
break;
case ROCKER_TEST_DMA_SIZE:
- r->test_dma_size = val;
+ r->test_dma_size = val & 0xFFFF;
break;
case ROCKER_TEST_DMA_ADDR + 4:
r->test_dma_addr = ((uint64_t)val) << 32 | r->lower32;
--
2.7.4
- [Qemu-devel] [PULL 0/9] Net patches, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 1/9] net: pcnet: check rx/tx descriptor ring length, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 2/9] net: pcnet: fix source formatting and indentation, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 3/9] tap-bsd: OpenBSD uses tap(4) now, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 4/9] net: eepro100: fix memory leak in device uninit, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 5/9] net: rocker: set limit to DMA buffer size,
Jason Wang <=
- [Qemu-devel] [PULL 6/9] e1000e: Don't zero out buffer address in rx descriptor, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 7/9] net: vmxnet: initialise local tx descriptor, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 8/9] net: rtl8139: limit processing of ring descriptors, Jason Wang, 2016/10/25
- [Qemu-devel] [PULL 9/9] colo-proxy: fix memory leak, Jason Wang, 2016/10/25
Re: [Qemu-devel] [PULL 0/9] Net patches, Peter Maydell, 2016/10/27