[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-arm] [PATCH v1 1/2] cadence_gem: Avoid infinite loops with a misco

From: Alistair Francis
Subject: [Qemu-arm] [PATCH v1 1/2] cadence_gem: Avoid infinite loops with a misconfigured buffer
Date: Tue, 21 Jun 2016 13:03:50 -0700

A guest can write zero to the DMACFG resulting in an infinite loop when
it reaches the while(bytes_to_copy) loop.

To avoid this issue enforce a minimum size for the RX buffer. Hardware
does not have this enforcement and relies on the guest to set a non-zero

Signed-off-by: Alistair Francis <address@hidden>
Reported-by: Li Qiang <address@hidden>
Reported-by: P J P <address@hidden>

 hw/net/cadence_gem.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 0346f3e..e5f3c98 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState *nc, const 
uint8_t *buf, size_t size)
     bytes_to_copy = size;
+    /* Hardware allows a zero value here but warns against it. To avoid QEMU
+     * indefinite loops we enforce a minimum value here
+     */
+    if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) {
+        rxbufsize = GEM_DMACFG_RBUFSZ_MUL;
+    }
     /* Pad to minimum length. Assume FCS field is stripped, logic
      * below will increment it to the real minimum of 64 when
      * not FCS stripping

reply via email to

[Prev in Thread] Current Thread [Next in Thread]