From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58103) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S57OF-0000Hj-2W for qemu-devel@nongnu.org; Tue, 06 Mar 2012 22:18:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S57OD-000641-9o for qemu-devel@nongnu.org; Tue, 06 Mar 2012 22:18:10 -0500 Received: from mx1.redhat.com ([209.132.183.28]:17353) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S57OD-00063s-2I for qemu-devel@nongnu.org; Tue, 06 Mar 2012 22:18:09 -0500 From: Jason Wang Date: Wed, 07 Mar 2012 11:17:48 +0800 Message-ID: <20120307031748.6355.500.stgit@jason-ThinkPad-T400> In-Reply-To: <20120305030824.8515.53602.stgit@jason-ThinkPad-T400> References: <20120305030824.8515.53602.stgit@jason-ThinkPad-T400> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [1/6 V2 PATCH] rtl8139: limit transmission buffer size in c+ mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: stefanha@linux.vnet.ibm.com, mst@redhat.com, qemu-devel@nongnu.org, blauwirbel@gmail.com, benjamin.poirier@gmail.com, liguori@us.ibm.com, aurelien@aurel32.net The tx buffer would be re-allocated for tx descriptor with big size and without LS bit set, this would make guest driver could easily let qemu to allocate unlimited. In linux host, a glib failure were easy to be triggered: GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes This patch fix this by adding a limit. As the spec didn't tell the maximum size of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). Changes from V1: Drop the while statement and s->cplus_txbuffer check. Signed-off-by: Jason Wang --- hw/rtl8139.c | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-) diff --git a/hw/rtl8139.c b/hw/rtl8139.c index 05b8e1e..be4bc6a 100644 --- a/hw/rtl8139.c +++ b/hw/rtl8139.c @@ -2061,13 +2061,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) s->cplus_txbuffer_len); } - while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) + if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) { - s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE; - s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len); - - DPRINTF("+++ C+ mode transmission buffer space changed to %d\n", - s->cplus_txbuffer_len); + /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */ + txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset; + DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor" + "length to %d\n", txsize); } if (!s->cplus_txbuffer)