[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL V2 07/23] dp8393x: Implement packet size limit and RBAE interrupt
From: |
Jason Wang |
Subject: |
[PULL V2 07/23] dp8393x: Implement packet size limit and RBAE interrupt |
Date: |
Tue, 3 Mar 2020 18:10:26 +0800 |
From: Finn Thain <address@hidden>
Add a bounds check to prevent a large packet from causing a buffer
overflow. This is defensive programming -- I haven't actually tried
sending an oversized packet or a jumbo ethernet frame.
The SONIC handles packets that are too big for the buffer by raising
the RBAE interrupt and dropping them. Linux uses that interrupt to
count dropped packets.
Signed-off-by: Finn Thain <address@hidden>
Tested-by: Laurent Vivier <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/dp8393x.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index b5a9c6a..911f59e 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -137,6 +137,7 @@ do { printf("sonic ERROR: %s: " fmt, __func__ , ##
__VA_ARGS__); } while (0)
#define SONIC_TCR_CRCI 0x2000
#define SONIC_TCR_PINT 0x8000
+#define SONIC_ISR_RBAE 0x0010
#define SONIC_ISR_RBE 0x0020
#define SONIC_ISR_RDE 0x0040
#define SONIC_ISR_TC 0x0080
@@ -772,6 +773,14 @@ static ssize_t dp8393x_receive(NetClientState *nc, const
uint8_t * buf,
s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
+ if (pkt_size + 4 > dp8393x_rbwc(s) * 2) {
+ DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
+ s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
+ dp8393x_update_irq(s);
+ dp8393x_do_read_rra(s);
+ return pkt_size;
+ }
+
packet_type = dp8393x_receive_filter(s, buf, pkt_size);
if (packet_type < 0) {
DPRINTF("packet not for netcard\n");
--
2.5.0
- [PULL V2 11/23] dp8393x: Clear descriptor in_use field to release packet, (continued)
- [PULL V2 11/23] dp8393x: Clear descriptor in_use field to release packet, Jason Wang, 2020/03/03
- [PULL V2 13/23] dp8393x: Don't reset Silicon Revision register, Jason Wang, 2020/03/03
- [PULL V2 17/23] NetRxPkt: fix hash calculation of IPV6 TCP, Jason Wang, 2020/03/03
- [PULL V2 12/23] dp8393x: Always update RRA pointers and sequence numbers, Jason Wang, 2020/03/03
- [PULL V2 04/23] dp8393x: Have dp8393x_receive() return the packet size, Jason Wang, 2020/03/03
- [PULL V2 05/23] dp8393x: Update LLFA and CRDA registers from rx descriptor, Jason Wang, 2020/03/03
- [PULL V2 14/23] dp8393x: Don't stop reception upon RBE interrupt assertion, Jason Wang, 2020/03/03
- [PULL V2 16/23] NetRxPkt: Introduce support for additional hash types, Jason Wang, 2020/03/03
- [PULL V2 21/23] net/filter.c: Add Options to insert filters anywhere in the filter list, Jason Wang, 2020/03/03
- [PULL V2 06/23] dp8393x: Clear RRRA command register bit only when appropriate, Jason Wang, 2020/03/03
- [PULL V2 07/23] dp8393x: Implement packet size limit and RBAE interrupt,
Jason Wang <=
- [PULL V2 15/23] e1000e: Avoid hw_error if legacy mode used, Jason Wang, 2020/03/03
- [PULL V2 20/23] tests/test-replication.c: Add test for for secondary node continuing replication, Jason Wang, 2020/03/03
- [PULL V2 19/23] block/replication.c: Ignore requests after failover, Jason Wang, 2020/03/03
- [PULL V2 22/23] colo: Update Documentation for continuous replication, Jason Wang, 2020/03/03
- [PULL V2 23/23] l2tpv3: fix RFC number typo in qemu-options.hx, Jason Wang, 2020/03/03
- [PULL V2 08/23] dp8393x: Don't clobber packet checksum, Jason Wang, 2020/03/03
- [PULL V2 09/23] dp8393x: Use long-word-aligned RRA pointers in 32-bit mode, Jason Wang, 2020/03/03
- [PULL V2 18/23] hw: net: cadence_gem: Fix build errors in DB_PRINT(), Jason Wang, 2020/03/03
- Re: [PULL V2 00/23] Net patches, Peter Maydell, 2020/03/03