[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 08/33] Fix tulip breakage
From: |
Jason Wang |
Subject: |
[PULL 08/33] Fix tulip breakage |
Date: |
Tue, 16 Jun 2020 14:45:19 +0800 |
From: Helge Deller <deller@gmx.de>
The tulip network driver in a qemu-system-hppa emulation is broken in
the sense that bigger network packages aren't received any longer and
thus even running e.g. "apt update" inside the VM fails.
The breakage was introduced by commit 8ffb7265af ("check frame size and
r/w data length") which added checks to prevent accesses outside of the
rx/tx buffers.
But the new checks were implemented wrong. The variable rx_frame_len
counts backwards, from rx_frame_size down to zero, and the variable len
is never bigger than rx_frame_len, so accesses just can't happen and the
checks are unnecessary.
On the contrary the checks now prevented bigger packages to be moved
into the rx buffers.
This patch reverts the wrong checks and were sucessfully tested with a
qemu-system-hppa emulation.
Fixes: 8ffb7265af ("check frame size and r/w data length")
Buglink: https://bugs.launchpad.net/bugs/1874539
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
hw/net/tulip.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index 6cefc0a..57ecbe2 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -171,9 +171,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct
tulip_descriptor *desc)
len = s->rx_frame_len;
}
- if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
- return;
- }
pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
(s->rx_frame_size - s->rx_frame_len), len);
s->rx_frame_len -= len;
@@ -186,9 +183,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct
tulip_descriptor *desc)
len = s->rx_frame_len;
}
- if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
- return;
- }
pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
(s->rx_frame_size - s->rx_frame_len), len);
s->rx_frame_len -= len;
--
2.5.0
- [PULL 00/33] Net patches, Jason Wang, 2020/06/16
- [PULL 01/33] virtio-net: implement RSS configuration command, Jason Wang, 2020/06/16
- [PULL 04/33] virtio-net: reference implementation of hash report, Jason Wang, 2020/06/16
- [PULL 05/33] vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro, Jason Wang, 2020/06/16
- [PULL 03/33] tap: allow extended virtio header with hash info, Jason Wang, 2020/06/16
- [PULL 02/33] virtio-net: implement RX RSS processing, Jason Wang, 2020/06/16
- [PULL 06/33] virtio-net: add migration support for RSS and hash report, Jason Wang, 2020/06/16
- [PULL 07/33] virtio-net: align RSC fields with updated virtio-net header, Jason Wang, 2020/06/16
- [PULL 09/33] hw/net/tulip: Fix 'Descriptor Error' definition, Jason Wang, 2020/06/16
- [PULL 10/33] hw/net/tulip: Log descriptor overflows, Jason Wang, 2020/06/16
- [PULL 08/33] Fix tulip breakage,
Jason Wang <=
- [PULL 11/33] net: cadence_gem: Fix debug statements, Jason Wang, 2020/06/16
- [PULL 16/33] net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState, Jason Wang, 2020/06/16
- [PULL 14/33] net: cadence_gem: Define access permission for interrupt registers, Jason Wang, 2020/06/16
- [PULL 12/33] net: cadence_gem: Fix the queue address update during wrap around, Jason Wang, 2020/06/16
- [PULL 13/33] net: cadence_gem: Fix irq update w.r.t queue, Jason Wang, 2020/06/16
- [PULL 15/33] net: cadence_gem: Set ISR according to queue in use, Jason Wang, 2020/06/16
- [PULL 17/33] net: cadence_gem: Fix up code style, Jason Wang, 2020/06/16
- [PULL 18/33] net: cadence_gem: Add support for jumbo frames, Jason Wang, 2020/06/16
- [PULL 19/33] net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg, Jason Wang, 2020/06/16
- [PULL 20/33] net: cadence_gem: Update the reset value for interrupt mask register, Jason Wang, 2020/06/16