From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34821) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bHXmz-0002w2-Jj for qemu-devel@nongnu.org; Mon, 27 Jun 2016 10:45:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bHXmx-0008Al-K7 for qemu-devel@nongnu.org; Mon, 27 Jun 2016 10:45:28 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:57999) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bHXmx-000844-DB for qemu-devel@nongnu.org; Mon, 27 Jun 2016 10:45:27 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.84_2) (envelope-from ) id 1bHXmj-0005Rn-Dr for qemu-devel@nongnu.org; Mon, 27 Jun 2016 15:45:13 +0100 From: Peter Maydell Date: Mon, 27 Jun 2016 15:44:55 +0100 Message-Id: <1467038710-24307-4-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1467038710-24307-1-git-send-email-peter.maydell@linaro.org> References: <1467038710-24307-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PULL 03/18] cadence_gem: Avoid infinite loops with a misconfigured buffer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org From: Alistair Francis A guest can write zero to the DMACFG resulting in an infinite loop when it reaches the while(bytes_to_copy) loop. To avoid this issue enforce a minimum size for the RX buffer. Hardware does not have this enforcement and relies on the guest to set a non-zero value. Signed-off-by: Alistair Francis Reported-by: Li Qiang Reported-by: P J P Message-id: 84bb1c391b833275da3f573d4972920cea34c188.1466539342.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell --- hw/net/cadence_gem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c index 0346f3e..e5f3c98 100644 --- a/hw/net/cadence_gem.c +++ b/hw/net/cadence_gem.c @@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size) GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL; bytes_to_copy = size; + /* Hardware allows a zero value here but warns against it. To avoid QEMU + * indefinite loops we enforce a minimum value here + */ + if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) { + rxbufsize = GEM_DMACFG_RBUFSZ_MUL; + } + /* Pad to minimum length. Assume FCS field is stripped, logic * below will increment it to the real minimum of 64 when * not FCS stripping -- 1.9.1