cadence_gem: Avoid infinite loops with a misconfigured buffer
A guest can write zero to the DMACFG resulting in an infinite loop when it reaches the while(bytes_to_copy) loop. To avoid this issue enforce a minimum size for the RX buffer. Hardware does not have this enforcement and relies on the guest to set a non-zero value. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Reported-by: P J P <ppandit@redhat.com> Message-id: 84bb1c391b833275da3f573d4972920cea34c188.1466539342.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
parent
f6cf41932e
commit
f265ae8c79
|
@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
|
|||
GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL;
|
||||
bytes_to_copy = size;
|
||||
|
||||
/* Hardware allows a zero value here but warns against it. To avoid QEMU
|
||||
* indefinite loops we enforce a minimum value here
|
||||
*/
|
||||
if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) {
|
||||
rxbufsize = GEM_DMACFG_RBUFSZ_MUL;
|
||||
}
|
||||
|
||||
/* Pad to minimum length. Assume FCS field is stripped, logic
|
||||
* below will increment it to the real minimum of 64 when
|
||||
* not FCS stripping
|
||||
|
|
Loading…
Reference in a new issue