[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/5] net: e1000e: fix an infinite loop issue
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 5/5] net: e1000e: fix an infinite loop issue |
Date: |
Wed, 15 Feb 2017 11:53:22 +0800 |
From: Li Qiang <address@hidden>
This issue is like the issue in e1000 network card addressed in
this commit:
e1000: eliminate infinite loops on out-of-bounds transfer start.
Signed-off-by: Li Qiang <address@hidden>
Reviewed-by: Dmitry Fleytman <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/e1000e_core.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index c99e2fb..28c5be1 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -806,7 +806,8 @@ typedef struct E1000E_RingInfo_st {
static inline bool
e1000e_ring_empty(E1000ECore *core, const E1000E_RingInfo *r)
{
- return core->mac[r->dh] == core->mac[r->dt];
+ return core->mac[r->dh] == core->mac[r->dt] ||
+ core->mac[r->dt] >= core->mac[r->dlen] / E1000_RING_DESC_LEN;
}
static inline uint64_t
@@ -1522,6 +1523,10 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct
NetRxPkt *pkt,
desc_size = core->rx_desc_buf_size;
}
+ if (e1000e_ring_empty(core, rxi)) {
+ return;
+ }
+
base = e1000e_ring_head_descr(core, rxi);
pci_dma_read(d, base, &desc, core->rx_desc_len);
--
2.7.4
- [Qemu-devel] [PULL 0/5] Net patches, Jason Wang, 2017/02/14
- [Qemu-devel] [PULL 1/5] net: Mark 'vlan' parameter as deprecated, Jason Wang, 2017/02/14
- [Qemu-devel] [PULL 2/5] net: e1000e: fix dead code in e1000e_write_packet_to_guest, Jason Wang, 2017/02/14
- [Qemu-devel] [PULL 3/5] colo-compare: sort TCP packet queue by sequence number, Jason Wang, 2017/02/14
- [Qemu-devel] [PULL 4/5] net: imx: limit buffer descriptor count, Jason Wang, 2017/02/14
- [Qemu-devel] [PULL 5/5] net: e1000e: fix an infinite loop issue,
Jason Wang <=
- Re: [Qemu-devel] [PULL 0/5] Net patches, Peter Maydell, 2017/02/16