From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:45673)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1bAX83-00072n-1Q
	for qemu-devel@nongnu.org; Wed, 08 Jun 2016 02:38:16 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1bAX7y-0003o8-SJ
	for qemu-devel@nongnu.org; Wed, 08 Jun 2016 02:38:13 -0400
Received: from mx1.redhat.com ([209.132.183.28]:43910)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jasowang@redhat.com>) id 1bAX7y-0003nr-MU
	for qemu-devel@nongnu.org; Wed, 08 Jun 2016 02:38:10 -0400
References: <1464849867-20184-1-git-send-email-ppandit@redhat.com>
	<CAFEAcA_a1nRknWwbu4SS2ehMp6o-4OgOQoTntRbSM5fSD3RVZw@mail.gmail.com>
	<alpine.LFD.2.20.1606030111290.25915@wniryva>
	<alpine.LFD.2.20.1606071029410.30819@wniryva>
From: Jason Wang <jasowang@redhat.com>
Message-ID: <5757BD4A.4070904@redhat.com>
Date: Wed, 8 Jun 2016 14:38:02 +0800
MIME-Version: 1.0
In-Reply-To: <alpine.LFD.2.20.1606071029410.30819@wniryva>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] [PATCH] net: mipsnet: check transmit buffer size
 before sending
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: P J P <ppandit@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>, Leon Alrae <leon.alrae@imgtec.com>, Li Qiang <liqiang6-s@360.cn>, Qemu Developers <qemu-devel@nongnu.org>, Aurelien Jarno <aurelien@aurel32.net>



On 2016=E5=B9=B406=E6=9C=8807=E6=97=A5 13:02, P J P wrote:
> +-- On Fri, 3 Jun 2016, P J P wrote --+
> | +-- On Thu, 2 Jun 2016, Peter Maydell wrote --+
> | | >      case MIPSNET_TX_DATA_COUNT:
> | | > -       s->tx_count =3D (val <=3D MAX_ETH_FRAME_SIZE) ? val : 0;
> | | > +        s->tx_count =3D (val < MAX_ETH_FRAME_SIZE) ? val : MAX_E=
TH_FRAME_SIZE;
> | | >          s->tx_written =3D 0;
> | |
> | | This is a behaviour change -- the register will now read
> | | back as MAX_ETH_FRAME_SIZE rather than 0 if written with
> | | an overlarge value.
> |
> |   IIUC, 's->tx_count' indicates expected packet data length to be pro=
cessed.
> | Maybe if this value was zero, packet was not to be sent; not sure.
> |
> | | Do we have any documentation on how this (simulated)
> | | device is supposed to behave in this case?
>
> @Jason: @Leon: ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

I could not find its docs, and the driver were even removed from linux=20
kernel since it was no longer supported.

We need to fix this issue, but instead of changing the behavior, is it=20
better the add a check in MIPSNET_TX_DATA_BUFFER?

Thanks