From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:41604) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4V3a-00043T-Pa for qemu-devel@nongnu.org; Mon, 05 Mar 2012 05:22:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S4V3Z-0002uZ-2W for qemu-devel@nongnu.org; Mon, 05 Mar 2012 05:22:18 -0500 Received: from e06smtp12.uk.ibm.com ([195.75.94.108]:47440) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4V3Y-0002td-Ps for qemu-devel@nongnu.org; Mon, 05 Mar 2012 05:22:16 -0500 Received: from /spool/local by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 5 Mar 2012 10:22:10 -0000 Received: from d06av05.portsmouth.uk.ibm.com (d06av05.portsmouth.uk.ibm.com [9.149.37.229]) by d06nrmr1707.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q25AM72C2224326 for ; Mon, 5 Mar 2012 10:22:08 GMT Received: from d06av05.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av05.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q25AM455013050 for ; Mon, 5 Mar 2012 03:22:05 -0700 Date: Mon, 5 Mar 2012 08:31:03 +0000 From: Stefan Hajnoczi Message-ID: <20120305083103.GA20600@stefanha-thinkpad.localdomain> References: <20120305030824.8515.53602.stgit@jason-ThinkPad-T400> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120305030824.8515.53602.stgit@jason-ThinkPad-T400> Subject: Re: [Qemu-devel] [PATCH 1/6] rtl8139: limit transmission buffer size in c+ mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jason Wang Cc: benjamin.poirier@gmail.com, aliguori@us.ibm.com, qemu-devel@nongnu.org, aurelien@aurel32.net, mst@redhat.com On Mon, Mar 05, 2012 at 11:08:24AM +0800, Jason Wang wrote: > The tx buffer would be re-allocated for tx descriptor with big size > and without LS bit set, this would make guest driver could easily let > qemu to allocate unlimited. > > In linux host, a glib failure were easy to be triggered: > > GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes > > This patch fix this by adding a limit. As the spec didn't tell the maximum size > of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). > > Signed-off-by: Jason Wang > --- > hw/rtl8139.c | 9 ++++----- > 1 files changed, 4 insertions(+), 5 deletions(-) > > diff --git a/hw/rtl8139.c b/hw/rtl8139.c > index 05b8e1e..d9e742c 100644 > --- a/hw/rtl8139.c > +++ b/hw/rtl8139.c > @@ -2063,11 +2063,10 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) > > while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) > { > - s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE; > - s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len); > - > - DPRINTF("+++ C+ mode transmission buffer space changed to %d\n", > - s->cplus_txbuffer_len); > + /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */ > + txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset; > + DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor" > + "length to %d\n", txsize); This makes sense to me since a 64 KB MTU is not possible - it's a safe upper limit that will not impact guests. Please change this while statement to an if statement and drop the s->cplus_txbuffer check (which is always true since we allocate immediately prior, if it is not already allocated). Stefan