From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47842) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VqOXS-0006r6-36 for qemu-devel@nongnu.org; Tue, 10 Dec 2013 09:43:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VqOXM-0000Wd-Pt for qemu-devel@nongnu.org; Tue, 10 Dec 2013 09:43:53 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:43342) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VqOXM-0000S5-JU for qemu-devel@nongnu.org; Tue, 10 Dec 2013 09:43:48 -0500 From: Peter Maydell Date: Tue, 10 Dec 2013 14:43:21 +0000 Message-Id: <1386686613-2390-26-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1386686613-2390-1-git-send-email-peter.maydell@linaro.org> References: <1386686613-2390-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PULL 25/37] net/cadence_gem: Fix rx multi-fragment packets List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Blue Swirl , qemu-devel@nongnu.org, Aurelien Jarno From: Peter Crosthwaite Bytes_to_copy was being updated before its final use where it advances the rx buffer pointer. This was causing total mayhem, where packet data for any subsequent fragments was being fetched from the wrong place. Reported-by: Deepika Dhamija Signed-off-by: Peter Crosthwaite Reviewed-by: Peter Maydell Message-id: c2a1c65c1fd06eb274442a0fa4a6839d940e145e.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell --- hw/net/cadence_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c index 8cfad04..2afafdf 100644 --- a/hw/net/cadence_gem.c +++ b/hw/net/cadence_gem.c @@ -733,8 +733,8 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size) /* Copy packet data to emulated DMA buffer */ cpu_physical_memory_write(rx_desc_get_buffer(s->rx_desc) + rxbuf_offset, rxbuf_ptr, MIN(bytes_to_copy, rxbufsize)); - bytes_to_copy -= MIN(bytes_to_copy, rxbufsize); rxbuf_ptr += MIN(bytes_to_copy, rxbufsize); + bytes_to_copy -= MIN(bytes_to_copy, rxbufsize); /* Update the descriptor. */ if (first_desc) { -- 1.8.5